CVE-2025-4851 | TOTOLINK N300RH 6.1c.1390_B20191101 /cgi-bin/cstecgi.cgi setUploadUserData FileName command injection

A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to command injection.

This vulnerability was named CVE-2025-4851. The attack can be initiated remotely. Furthermore, there is an exploit available.