CVE-2025-7862 is a high (CVSS 7.3) missing authentication on the telnet setting in TOTOLINK T6 mesh Wi-Fi router (firmware 4.1.5cu.748_B20211015). A fixed version is named in the advisory. Do not expose the product to untrusted networks until you have confirmed a fix.
What's affected
The record lists firmware 4.1.5cu.748_B20211015 as affected. The vulnerable code is in /cgi-bin/cstecgi.cgi, through the telnet_enabled argument.
No patched firmware is named in the record or in the write-up. Check the TOTOLINK download page for your model.
The setTelnetCfg function in the cstecgi.cgi component can switch the telnet service on without checking who is asking. The write-up says this gives a remote shell on the device. The record gives the impact as low across the three CIA ratings, so treat the write-up's description of the end result as the researcher's claim.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, a score of 7.3. The write-up shows no vendor acknowledgment.
The record's kev flag is false, so the CVE is not in CISA's Known Exploited Vulnerabilities catalog at the time of this review.
How to check if you're exposed
Find the model and firmware version on the device's status page or, if you manage many devices, in your asset inventory. Then confirm whether the management interface is reachable from outside your network. From a machine outside your perimeter:
nmap -Pn -p 23,80,443,8080 YOUR_PUBLIC_ADDRESS
If the web management port answers from the internet, treat the device as exposed whatever its firmware says.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Confirm whether you operate a TOTOLINK T6 and which firmware it runs.
- Disable remote management and keep the router's web interface off the internet.
- Check the TOTOLINK download page for firmware newer than 4.1.5cu.748_B20211015.
- Check whether the telnet service is enabled and turn it off if you do not need it.
- If no update ships, replace the device.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-287 (improper authentication), CWE-306 (missing authentication for a critical function). A function that changes a security relevant setting has to check who is calling it. When the check is missing, being able to reach the service is the only barrier.
Quick check
Which version fixes CVE-2025-7862?
No patched firmware is named in the record or in the write-up. Check the TOTOLINK download page for your model.
Is CVE-2025-7862 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. The record does say the exploit has been disclosed to the public, so assume attackers can find it.
Sources
- Safeguard Gold entry for CVE-2025-7862
- Public write-up on GitHub
- NVD record data for CVE-2025-7862, published 2025-07-20, source cna@vuldb.com
Last reviewed: 18 October 2026.
