Low severity · published Jun 16, 2025
CVE-2025-6139
TOTOLINK T10 shadow.sample hard-coded password
3.9
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Adjacent
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
T1
T10 · TOTOLINK
4.1.8cu.5207 · source: vendor
TF
T10 Firmware · Totolink
4.1.8cu.5207_b20210320 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6139
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6139
Exploit
https://candle-throne-f75.notion.site/TOTOLINK-T10-shadow-20ddf0aa118580f5a455cd5dbc521472
Permissions Required
https://vuldb.com/?ctiid.312608
Third Party Advisory
https://vuldb.com/?id.312608
Third Party Advisory
https://vuldb.com/?submit.592922
Product
https://www.totolink.net/
More from T10
9.8
CVE-2025-9533
TOTOLINK T10 formLoginAuth.htm improper authentication
9.8
CVE-2025-4496
TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow
8.8
CVE-2025-6138
TOTOLINK T10 HTTP POST Request cstecgi.cgi setWizardCfg buffer overflow
8.8
CVE-2025-6137
TOTOLINK T10 HTTP POST Request cstecgi.cgi setWiFiScheduleCfg buffer overflow
8.8
CVE-2025-5905
TOTOLINK T10 POST Request cstecgi.cgi setWiFiRepeaterCfg buffer overflow