CVE-2025-51390

The vulnerability results from insufficient validation of input data of the 'pin' parameter passed to the setWiFiWpsConfig function in the router's firmware. An attacker can provide a crafted parameter value containing malicious system commands, which will be executed directly by the device's command interpreter. The attack does not require authentication or user interaction, and can be performed remotely over the network.

An attacker gains the ability to execute arbitrary commands with the router's operating system privileges, which may result in complete device takeover, disclosure of confidential data, modification of network configuration, or use of the router as an entry point for further attacks on the internal network.

Apply patches available from the manufacturer according to references. In case of missing updates, it is recommended to restrict access to the device management interface only to trusted IP addresses and disable WPS functionality if not required.

TOTOLINK N600R in firmware version V4.3.0cu.7647_B20210106