CVE-2025-6139: totolink t10_firmware Credentials Management Errors

Vulnerability summary

CVE-2025-6139 is a low (CVSS 3.9) Credentials Management Errors vulnerability in totolink t10_firmware. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-06-2025
   PublishedVulnerability first disclosed.
2. 17-06-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

• CWE-255Credentials Management ErrorsWeaknesses in this category are related to the management of credentials.
• CWE-259Use of Hard-coded PasswordThe product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.