CVE-2025-51452
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In TOTOLINK A7000R firmware version 9.1.0u.6115_B20201022, a vulnerability allows login bypass. An attacker can send a crafted request to formLoginAuth.htm to gain unauthorized access.
Risk Assessment
The risk involves potential takeover of the router without valid credentials, leading to network and data security breaches.
Recommendation
Immediately update the firmware to the latest version and restrict administrative panel access to trusted IP addresses only.
Other vulnerabilities in TOTOLINK A7000R
See all- CVE-2022-32993Critical
An access control issue was discovered in the TOTOLINK A7000R router running firmware version V4.1cu.4134, specifically in the /cgi-bin/ExportSettings.sh script. Lack of proper authentication allows unauthorized access to export device settings.
- CVE-2025-63462High
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Original NVD description (English source)
In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS