Totolink T6 Firmware
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Totolink T6 Firmware.
By the Year
In 2026 there have been 0 vulnerabilities in Totolink T6 Firmware. Last year, in 2025 T6 Firmware had 14 security vulnerabilities published. Right now, T6 Firmware is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 14 | 8.87 |
It may take a day or so for new T6 Firmware vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Totolink T6 Firmware Security Vulnerabilities
TOTOLINK T6 v4.1.5cu.748 B20211015 RCE via MQTT Packet Handler
CVE-2025-8170
8.8 - High
- July 25, 2025
A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerability affects the function tcpcheck_net of the file /router/meshSlaveDlfw of the component MQTT Packet Handler. The manipulation of the argument serverIp leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Buffer Overflow
Command Injection RCE in MQTT Packet Handler of TOTOLINK T6 (v4.1.5cu.748)
CVE-2025-7952
8.8 - High
- July 22, 2025
A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Command Injection
TOTOLINK T6 4.1.5cu.748 Buffer Overflow in MQTT Service (updateWifiInfo)
CVE-2025-7913
8.8 - High
- July 21, 2025
A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. Affected is the function updateWifiInfo of the component MQTT Service. The manipulation of the argument serverIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Buffer Overflow
TOTOLINK T6 MQTT Service RecvSlaveUpgstatus Buffer Overflow (4.1.5cu)
CVE-2025-7912
8.8 - High
- July 20, 2025
A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B20211015. This issue affects the function recvSlaveUpgstatus of the component MQTT Service. The manipulation of the argument s leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Buffer Overflow
TOTOLINK T6 4.1.5cu.748 Telnet Service Missing Auth via setTelnetCfg
CVE-2025-7862
9.8 - Critical
- July 20, 2025
A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnet_enabled with the input 1 leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
authentification
TOTOLINK T6 4.1.5cu.748_B20211015 MQTT Service dest buffer overflow
CVE-2025-7837
8.8 - High
- July 19, 2025
A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this issue is the function recvSlaveStaInfo of the component MQTT Service. The manipulation of the argument dest leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Buffer Overflow
TOTOLINK T6 v4.1.5cu.748 Buffer Overflow in setDiagnosisCfg (HTTP POST Handler)
CVE-2025-7758
8.8 - High
- July 17, 2025
A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Buffer Overflow
Command Injection in TOTOLINK T6 4.1.5cu.748 via clearPairCfg
CVE-2025-7615
8.8 - High
- July 14, 2025
A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Command Injection
TOTOLINK T6 4.1.5cu.748 delDevice CMD Injection in HTTP POST Handler
CVE-2025-7614
8.8 - High
- July 14, 2025
A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Command Injection
TOTOLINK T6 4.1.5cu.748 HTTP POST RCE via ip param
CVE-2025-7613
8.8 - High
- July 14, 2025
A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affects the function CloudSrvVersionCheck of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Command Injection
TOTOLINK T6 4.1.5cu.748 Command INJ in setTracerouteCfg via HTTP POST Handler
CVE-2025-7525
8.8 - High
- July 13, 2025
A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument command leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Command Injection
Critical Command Injection in TOTOLINK T6 4.1.5cu.748 via /cgi-bin/cstecgi.cgi
CVE-2025-7524
8.8 - High
- July 13, 2025
A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Command Injection
TOTOLINK T6 4.1.5cu Buffer Overflow in setWiFiAclRules (HTTP POST)
CVE-2025-7460
8.8 - High
- July 11, 2025
A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Buffer Overflow
Critical: TOTOLINK T6 4.1.5cu.748 Bypass Auth via Form_Login authCode/goURL
CVE-2025-6916
8.8 - High
- June 30, 2025
A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.
authentification
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Totolink T6 Firmware or by Totolink? Click the Watch button to subscribe.
