CVE-2025-4849 is a medium severity command injection (CVSS 6.3) in the TOTOLINK N300RH router, firmware 6.1c.1390_B20191101. The url argument of the function CloudACMunualUpdateUserdata in /cgi-bin/cstecgi.cgi is passed on unsafely. No fixed firmware is listed, so keep the admin interface off the internet.
What's affected
The record names the TOTOLINK N300RH with firmware 6.1c.1390_B20191101. The weak spot is the function CloudACMunualUpdateUserdata in the CGI program /cgi-bin/cstecgi.cgi, which is the router's web management backend. The url argument is not checked before it is used, which leads to command injection. The record says the attack can be launched remotely.
The record files the flaw under CWE-74 (Injection), CWE-77 (Command Injection), the general injection class and the more specific case of operating system commands.
No fixed firmware version is given. The references are a public write up, VulDB entries and the vendor home page. Check the TOTOLINK download page for your exact hardware revision before assuming a newer build addresses it.
The base vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. It needs low privileges, so an attacker would normally need a login to the management interface, and the impact is rated low on confidentiality, integrity and availability. The score is therefore medium, though a router is a sensitive place for any code execution flaw.
How to check if you're exposed
Confirm the model and firmware first. Log in to the router's management page and open the status or system page, which lists the firmware version. If it reads 6.1c.1390_B20191101 on an N300RH, it matches the record.
Next, check where the management interface can be reached from. On most routers you can see whether remote management is enabled in the administration settings. If the admin page answers on the WAN side, turn that off.
Then check the login. A vendor default password is the easiest way to satisfy the low privilege requirement, so confirm that the admin password is long and unique.
If you manage many devices, look for the CGI path in your network scans or web logs. Requests to /cgi-bin/cstecgi.cgi from outside your trusted network are a sign that someone is probing the admin backend.
What to do now
- Turn off remote management on the router so the admin interface cannot be reached from the internet.
- Change the admin password to a long unique value and remove any extra accounts.
- Check the TOTOLINK download page for newer firmware for the N300RH, and read its notes before installing. The record lists no fix for CVE-2025-4849.
- Restrict the admin interface to one trusted device or a management VLAN where the router allows it.
- If the router is old or has no update path, replace it with a model that is still supported.
- Review the router configuration for settings you did not make, such as DNS servers, port forwards or remote access.
Why it matters
Command injection happens when a program builds an operating system command from input without cleaning it, so the input can add its own instructions. A router is a sensitive host, so even a flaw that needs a login deserves attention beyond what the score alone suggests. The class is CWE-74 (Injection), CWE-77 (Command Injection).
The CVE record notes that an exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Two reports against the same CGI program in one day also suggest that the whole management backend deserves caution, not just the function in this record.
For a home or small office, the practical risk comes from the router being the gateway for every other device. Anything that alters its settings can redirect traffic. That is why the cheapest control, keeping the admin page off the internet, is also the best one.
Quick check
Is there fixed firmware for CVE-2025-4849?
The CVE record lists none. Check the TOTOLINK download page for your hardware revision and read the release notes. If there is no update, restrict the admin interface and consider replacing the router.
Is CVE-2025-4849 being exploited in the wild?
The record says an exploit has been disclosed to the public, which is not the same as confirmed attacks. It is not on the CISA Known Exploited Vulnerabilities list. Treat any exposed instance as likely to be probed.
Sources
- NVD record for CVE-2025-4849
- github.com reference
- vuldb.com reference
- vuldb.com reference
- vuldb.com reference
- www.totolink.net reference
Last reviewed: 18 October 2026.
