CVE-2025-6916CWE-287CWE-306

TOTOLINK T6 formLoginAuth.htm Form_Login missing authentication

High · published June 30, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
58.9
In the wild
Unconfirmed
What it is

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00888 · 58.9th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2025-06-30T17:02Z
EPSS history
Timeline
  • 30 JUN 17:02Z
    TOTOLINK T6 formLoginAuth.htm Form_Login missing authentication
    cvelistv5