CVE-2025-51452 is a critical (CVSS 9.8) login bypass in the TOTOLINK A7000R router, firmware 9.1.0u.6115_B20201022. The record says an attacker can skip authentication by sending a specific request to formLoginAuth.htm. No fixed firmware is confirmed, so check TOTOLINK's download page and restrict access.
What's affected
TOTOLINK A7000R running firmware 9.1.0u.6115_B20201022, per the record. The flaw sits in the login handling behind formLoginAuth.htm. The firmware build date in the version string is October 2020, which suggests an older release. Check whether newer firmware exists for your hardware revision.
The record names no fixed firmware. It lists a TOTOLINK download page for the model and a public write-up. I did not confirm which firmware release, if any, closes the issue, so read the release notes on the vendor page before you flash anything.
How to check if you're exposed
Open the router's management page and read the firmware version under system or status. If it matches the version above, treat the device as affected.
Then check who can reach the management page. From outside your network, the page should not answer on the router's public address. Look at the remote management and port forwarding settings in the router, and turn off remote administration if you do not need it.
For many devices, ask for an inventory of routers and extenders with firmware versions. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where.
What to do now
- Find every A7000R and note its firmware version.
- Turn off remote administration, and make sure the management page is reachable only from a trusted internal address.
- Check the vendor download page for newer firmware, read the notes, and update if a release addresses login handling.
- Change the admin password and any Wi-Fi keys if you suspect the device was exposed.
- If no fix appears, plan to replace the device with one that still receives security updates.
Why it matters
The record classifies this as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The weakness is an authentication bypass through an alternate path or channel: the device offers a route to the protected function that does not run the normal login check. The sibling entry CVE-2025-51451 describes the same endpoint on another TOTOLINK model, which hints at shared code across products.
The CVSS vector is the worst combination for a network device: remote, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. A router is the front door of a small network, so an administrator level takeover can mean changed DNS settings, watched traffic or a foothold inside.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild. A public write-up is referenced.
Quick check
Is there a patched firmware for the A7000R?
I could not confirm one. The record lists no fixed version. A TOTOLINK download page is referenced, so check its release notes.
Do I need credentials to exploit it?
No, per the record: the CVSS vector lists no privileges required, and the description says the login can be bypassed.
Sources
Last reviewed: 18 October 2026.
