PT-2025-18655 · Totolink · Totolink Cpe Cp900

Published 2025-04-01 · Updated 2025-05-03 · CVE-2025-44836

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TOTOLINK CPE CP900 version 6.3c.1144 B20190715

Description A command injection issue was found in the setApRebootScheCfg function through the hour or minute parameters. This allows attackers to execute arbitrary commands via a manipulated request.

Recommendations For TOTOLINK CPE CP900 version 6.3c.1144 B20190715, consider disabling the setApRebootScheCfg function until a patch is available to prevent exploitation. Restrict access to the hour and minute parameters in the affected function to minimize the risk of command injection.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-06193

CVE-2025-44836

Affected Products

Totolink Cpe Cp900

References · 6

• 🔥 https://github.com/n0wstr/IOTVuln/tree/main/CP900/setApRebootScheCfg · Exploit
• https://bdu.fstec.ru/vul/2025-06193 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-44836 · Security Note
• https://osv.dev/vulnerability/CVE-2025-44836 · Vendor Advisory
• https://t.me/cvedetector/24232 · Telegram Post
• https://twitter.com/CVEnew/status/1918568520880931152 · Twitter Post