CVE-2025-4850 in N300RH
Summary
by MITRE • 05/18/2025
A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/24/2025
The vulnerability identified as CVE-2025-4850 represents a critical command injection flaw within the TOTOLINK N300RH router firmware version 6.1c.1390_B20191101. This issue resides in the cstecgi.cgi script, specifically within the setUnloadUserData function that handles the plugin_name parameter. The affected device operates with a web-based administration interface that processes user inputs through the cgi-bin framework, creating a potential attack surface where malicious input can be executed as system commands. The vulnerability's classification as critical stems from its remote exploitability and the potential for full system compromise through command injection attacks.
The technical exploitation of this vulnerability occurs through manipulation of the plugin_name argument in the setUnloadUserData function, which fails to properly validate or sanitize user-supplied input before processing. When an attacker submits malicious data through this parameter, the system directly incorporates the input into system command execution contexts without adequate sanitization measures. This allows for arbitrary command execution with the privileges of the web server process, which typically runs with elevated system permissions. The attack vector is remote, meaning that an unauthenticated attacker can exploit this vulnerability from outside the network without requiring physical access or prior authentication.
The operational impact of this vulnerability extends beyond simple command execution, as it provides attackers with complete control over the affected router's functionality. An attacker could potentially execute system commands to modify network configurations, install malicious software, access sensitive data, or establish persistent backdoors. The exploitation capability has been publicly disclosed, which significantly increases the risk to affected devices since attackers can readily leverage existing exploit code. This vulnerability affects not only the router's administrative functions but also its core networking capabilities, potentially allowing for man-in-the-middle attacks, network traffic interception, or complete network compromise.
Organizations and individuals utilizing affected TOTOLINK N300RH devices should immediately implement mitigation strategies including firmware updates from the vendor when available, network segmentation to isolate affected devices, and firewall rules to restrict access to the affected web interface. The vulnerability aligns with CWE-77 and CWE-94, which specifically address command injection and code injection flaws respectively. From an ATT&CK framework perspective, this vulnerability maps to T1059.001 for command and scripting interpreter and T1021.001 for remote services, indicating the potential for lateral movement and persistent access. Network monitoring should be enhanced to detect suspicious command execution patterns and unusual traffic to the cgi-bin endpoints, while also implementing input validation controls to prevent similar vulnerabilities in other network devices.