Command Injection Vulnerability in TOTOLINK N300RH Router
CVE-2025-4850

5.3MEDIUM

Key Information:

Vendor

Totolink
Status
N300rh
Vendor
CVE Published:
18 May 2025

What is CVE-2025-4850?

A significant command injection vulnerability exists in the TOTOLINK N300RH router, specifically within the setUnloadUserData function of the /cgi-bin/cstecgi.cgi file. This flaw arises from improper handling of the plugin_name argument, allowing attackers to execute arbitrary commands remotely. The vulnerability has been made public, increasing the risk of exploitation by malicious actors. Users are advised to apply patches and monitor their network security closely.

Affected Version(s)

N300RH 6.1c.1390_B20191101

References

https://vuldb.com/?id.309321
vdb-entrytechnical-description
https://vuldb.com/?ctiid.309321
signaturepermissions-required
https://vuldb.com/?submit.575073
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

DaddyShark (VulDB User)
.