CVE-2025-44846

The CVE-2025-44846 entry concerns TOTOLINK CA600-PoE vulnerable in the recvUpgradeNewFw function where the fwUrl parameter is not properly sanitized. Exploitation would allow remote command execution via a crafted request. Affected software/version: TOTOLINK CA600-PoE 5.3c.6665_B20180820. Documen...

CVE-2025-44844

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44846

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44854

TOTOLINK CP900 V6.3c.1144B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44848

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44867

The CVE describes a command-injection vulnerability in Tenda W20E V15.11.0.6, specifically in the formSetNetCheckTools function via the hostName parameter, allowing arbitrary command execution by crafted requests. Affected product: Tenda W20E. Root cause: failure to properly validate or filter sp...

CVE-2025-44840

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44848

TOTOLINK CA600-PoE, version 5.3c.6665_B20180820, contains a command injection flaw in the msg_process function triggered by the Url parameter. The vulnerability permits execution of arbitrary commands via a crafted request, with the CVE-2025-44848 entry documenting a network-facing exposure (base...

CVE-2025-44843

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

TOTOLINK CA300-PoE 安全漏洞

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the msgprocess function Url parameter failing to correctly filter constructive command special characters, commands, etc., which...

CVE-2025-44867

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44862

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44854

TOTOLINK CP900 V6.3c.1144B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44860

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44837

TOTOLINK CPE CP900 v6.3c.1144_B20190715 contains a command injection in CloudSrvUserdataVersionCheck. The vulnerability allows executing arbitrary commands via crafted requests using the url or magicid parameters. Affected component: CloudSrvUserdataVersionCheck function (Totolink CP900). Exploit...

CVE-2025-44863

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44860

TOTOLINK CA300-POE is affected (V6.2c.884_B20180522). The vulnerability is a command injection in the msg_process function via the Port parameter, allowing an attacker to execute arbitrary commands through a crafted request. The issue is rooted in insufficient input filtering for the Port paramet...

CVE-2025-44864

CVE-2025-44864 affects Tenda W20E (firmware V15.11.0.6). A command injection exists in the formSetDebugCfg function via the module parameter, enabling arbitrary commands with a crafted request. Public exploit details are not provided in the initial documents. CVSSv3.1 base score 6.3 (Medium), net...

CVE-2025-44841

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...