CVE-2025-9935 is a high severity (7.3, CVSS 3.1) command injection in TOTOLINK N600R firmware 4.3.0cu.7866_B20220506, in the web service at /web_cste/cgi-bin/cstecgi.cgi. No fixed firmware is confirmed in the sources we could read, so limit access to the admin interface and check TOTOLINK's site.
What's affected
The record lists the TOTOLINK N600R and its firmware, version 4.3.0cu.7866_B20220506. The record describes the function sub_4159F8 in /web_cste/cgi-bin/cstecgi.cgi and says the manipulation leads to command injection. It says remote exploitation is possible. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, no account needed, and limited impact on each of confidentiality, integrity and availability.
The researcher write-up we could read analyses the web service binary and describes the issue as a pre-authentication command injection, meaning no login is needed. That matches the record, whose vector requires no privileges. The write-up lists only the one firmware build above.
Fixed versions: none confirmed. The record links no TOTOLINK advisory and names no patched build. Check the TOTOLINK download page for your exact model and hardware revision.
The record says the exploit has been made public. It is not in the CISA Known Exploited Vulnerabilities catalog, and nothing we read reports exploitation in the wild.
How to check if you're exposed
Open the router's admin page and read the firmware version on the status or upgrade screen. A N600R on 4.3.0cu.7866_B20220506 is in scope.
Next, find out whether the admin web service is reachable from outside your network. From a device that is not on your LAN, try to load the router's public address on its admin port. If the login page loads, remote management is enabled and the risk is real.
If you run many routers, ask your device inventory for every N600R and note the firmware build on each.
What to do now
- Disable remote web management and any port forward that points at the router's admin service.
- Put the router's admin interface on a management network that only trusted machines can reach.
- Check TOTOLINK's download page for firmware newer than 4.3.0cu.7866_B20220506. If you find one, read its notes and install it.
- If the model is end of life or has no newer firmware, plan to replace it.
- Watch for unexpected configuration changes, new accounts, or outbound connections from the router.
Why it matters
The weakness classes are CWE-74 (injection) and CWE-77 (command injection). In router firmware, a web handler that passes request data into a system command can let a remote user run commands on the device. The impact depends on how the handler runs, and on this class of device it usually means the router itself is compromised.
Small routers sit at the edge of a network and rarely get patched on a schedule. A public write-up shortens the time between disclosure and scanning, so removing remote access is the step that works today.
Quick check
Is there a fix for the TOTOLINK N600R?
We could not confirm one. The record and the pages we could read name no patched firmware, so check TOTOLINK's support page for your exact hardware revision.
Can I rely on turning off remote management?
It removes the internet facing path, which is the most likely route. Anyone already on your local network could still reach the admin service, so keep untrusted devices off it.
Sources
- Researcher write-up referenced by the record
- VulDB entry listed in the record (the page would not load for us, so nothing here relies on it)
- Gold vulnerability page
- Free in-browser dependency scan
Last reviewed: 18 October 2026.
