PT-2025-18653 · Totolink · Totolink Cpe Cp900

Published 2025-04-01 · Updated 2025-05-03 · CVE-2025-44838

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TOTOLINK CPE CP900 version 6.3c.1144 B20190715

Description A command injection issue was discovered in the setUploadUserData function through the FileName parameter. This issue allows attackers to execute arbitrary commands via a manipulated request.

Recommendations For TOTOLINK CPE CP900 version 6.3c.1144 B20190715, consider disabling the setUploadUserData function until a patch is available to prevent exploitation. Restrict access to the FileName parameter in the affected function to minimize the risk of arbitrary command execution.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-06195

CVE-2025-44838

Affected Products

Totolink Cpe Cp900

References · 6

• 🔥 https://github.com/n0wstr/IOTVuln/tree/main/CP900/setUploadUserData · Exploit
• https://osv.dev/vulnerability/CVE-2025-44838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-44838 · Security Note
• https://bdu.fstec.ru/vul/2025-06195 · Security Note
• https://twitter.com/CVEnew/status/1918568508805558652 · Twitter Post
• https://t.me/cvedetector/24234 · Telegram Post