PT-2025-26877 · Totolink · Totolink Ca300-Poe

Pjqwudi · Published 2025-06-25 · Updated 2025-06-28 · CVE-2025-6621

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884

Description: A critical issue has been found in the QuickSetting function of the file ap.so, allowing for os command injection through the manipulation of the hour/minute argument. This can be initiated remotely.

Recommendations: For TOTOLINK CA300-PoE version 6.2c.884, as a temporary workaround, consider disabling the QuickSetting function until a patch is available. Restrict access to the ap.so file to minimize the risk of exploitation. Avoid using the hour/minute argument in the affected function until the issue is resolved.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2025-10546

CVE-2025-6621

Affected Products

Totolink Ca300-Poe

References · 17

• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md#poc · Exploit, Deleted
• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md · Exploit, Deleted
• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.md#poc · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2025-6621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6621 · Security Note
• https://bdu.fstec.ru/vul/2025-10546 · Security Note
• https://twitter.com/VulmonFeeds/status/1937962357226889611 · Twitter Post
• https://vuldb.com/?ctiid.313838 · Note
• https://totolink.net · Note
• https://vuldb.com/?id.313839 · Note
• https://t.me/cvetracker/27047 · Telegram Post
• https://vuldb.com/?ctiid.313839 · Note
• https://vuldb.com/?submit.602266 · Note
• https://twitter.com/CVEnew/status/1937939404925899247 · Twitter Post
• ❌ https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.md · Note, Deleted