PT-2025-26872 · Totolink · Totolink Ca300-Poe

Pjqwudi · Published 2025-06-25 · Updated 2025-06-28 · CVE-2025-6618

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884

Description: A critical issue has been found, affecting the function SetWLanApcliSettings of the file wps.so. The manipulation of the argument PIN leads to os command injection. This issue can be exploited remotely.

Recommendations: For TOTOLINK CA300-PoE version 6.2c.884, as a temporary workaround, consider disabling the SetWLanApcliSettings function until a patch is available. Restrict access to the wps.so file to minimize the risk of exploitation. Avoid using the PIN argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2025-10544

CVE-2025-6618

Affected Products

Totolink Ca300-Poe

References · 13

• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_44/44.md#poc · Exploit, Deleted
• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_44/44.md · Exploit, Deleted
• https://bdu.fstec.ru/vul/2025-10544 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6618 · Security Note
• https://twitter.com/VulmonFeeds/status/1937970035974103343 · Twitter Post
• https://twitter.com/CVEnew/status/1937931931888263400 · Twitter Post
• https://twitter.com/SecAideInfo/status/1938903792419778807 · Twitter Post
• https://vuldb.com/?id.313836 · Note
• https://t.me/cvetracker/27044 · Telegram Post
• https://totolink.net · Note
• https://vuldb.com/?submit.602263 · Note
• https://vuldb.com/?ctiid.313836 · Note