External risk intelligence

TOTOLINK N600R Command Injection Vulnerability in setWiFiWpsConfig.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-51390

The product is a consumer router/gateway device. These devices are commonly deployed at the network edge to provide internet connectivity, and features like Wi-Fi WPS configuration are typically accessible via the device's web management interface, making the vulnerable service a common, externally reachable target.

OS Command Injection

Totolink N600r Firmware

4.3.0cu.7647_b20210106

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical command injection vulnerability has been identified in TOTOLINK N600R router firmware. This flaw allows unauthenticated remote attackers to execute arbitrary commands on affected devices, potentially leading to a complete compromise of the router and any network it manages. The main concern is confirming relevance and exposure.

Unauthenticated remote code execution risk.
Consumer routers are common network entry points.
Assess router exposure and confirm if it's a business risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request over the network to the affected device. This request would target the Wi-Fi WPS configuration feature, specifically exploiting a weakness in how the `pin` parameter is handled within the `setWiFiWpsConfig` function. Successful exploitation could allow an attacker to execute arbitrary commands on the device with high privileges.

No authentication or user interaction required.
Exploits `pin` parameter in `setWiFiWpsConfig` function.
Allows arbitrary command execution and device compromise.

Live Threat

Current exploitation, exposure, and threat context

A command injection vulnerability in the setWiFiWpsConfig function could allow an unauthenticated attacker to execute arbitrary commands on the affected device. This could impact the device's configuration and potentially its network access services when exposed to the internet.

Router configuration and network services.
Attacker sends malicious `pin` parameter.
Device control and unauthorized network access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts TOTOLINK N600R devices, suggesting a joint responsibility between infrastructure or platform teams managing network edge devices and potentially vendor management if third-party devices are involved. The immediate priority is to identify all deployed N600R units, assess their exposure (especially to the internet), confirm their criticality to business operations, and then assign an owner to develop a targeted remediation plan.

Infrastructure and vendor management teams own.
Confirm external reachability and criticality.
Plan targeted remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK N600R?

The TOTOLINK N600R is a consumer wireless router designed to provide home or small-office network connectivity. It manages internet traffic and Wi-Fi access for connected devices, acting as a gateway that links local systems to the broader internet. Because it handles core networking tasks, it includes management features, such as Wi-Fi Protected Setup (WPS), to simplify how users configure their wireless security settings.

What does CVE-2025-51390 mean?

This CVE describes a command injection vulnerability, classified as CWE-78. This weakness occurs when a program passes unsafe user-supplied data—in this case, the 'pin' parameter used for WPS configuration—directly to a system shell. By sending specially crafted input, an attacker can trick the router into executing unintended commands. This bypasses typical software restrictions, allowing the attacker to control the underlying operating system of the device.

How is this command injection triggered?

The vulnerability is triggered when an attacker sends a malicious request to the setWiFiWpsConfig function. Because this function does not properly sanitize the 'pin' input, the router processes the malicious code as a system command. Importantly, this does not require an attacker to have a valid login or perform any previous steps; the flaw is accessible through standard network requests sent directly to the vulnerable configuration interface.

Who should be concerned about this vulnerability?

Anyone using this specific TOTOLINK router model should be concerned, especially if the device's management interface is accessible from the internet. According to Halo Surface Signal, because this router is a gateway device often placed at the network edge, the management services are frequently exposed externally. This exposure makes it significantly easier for remote, unauthenticated actors to reach and exploit the vulnerable function.

Do I need to patch my TOTOLINK N600R?

If you are using this device, your first step is to locate all units in your environment and determine if they are exposed to the internet. Since this is a critical remote execution risk, you should treat these routers as high-priority assets. Consult the manufacturer for official firmware updates and verify your internal network policies to ensure that management interfaces are restricted to authorized users only, rather than left open to the public internet.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.