CVE-2025-44841

The TOTOLINK CA600-PoE (V5.3c.6665_B20180820) router is affected by a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is a lack of proper input validation and filtering for special characters, commands, and other elements within the version paramet...

CVE-2025-44841: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

TOTOLINK CA600-PoE security vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the CloudSrvUserdataVersionCheck function version parameter failing to correctly filter the constructor command special...

CVE-2025-44862

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44840

The TOTOLINK CA600-PoE outdoor wireless AP/CPE (specifically version V5.3c.6665_B20180820 ) is susceptible to a command injection vulnerability in the CloudSrvUserdataVersionCheck function. The flaw exists because the svn parameter fails to properly filter special characters and commands during p...

CVE-2025-44838: Improper Neutralization of Special Elements used in a Command

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44854: Improper Neutralization of Special Elements used in a Command

TOTOLINK CP900 V6.3c.1144B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44846: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44847

The TOTOLINK CA600-PoE outdoor wireless AP/CPE device (firmware version V5.3c.6665_B20180820 ) contains a command injection vulnerability in the setWebWlanIdx function. The flaw exists because the software fails to properly filter special characters or commands within the webWlanIdx parameter dur...

CVE-2025-44846

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

TOTOLINK CA600-PoE security vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the recvUpgradeNewFw function failing to properly filter construct command special characters, commands, etc. No detailed...

CVE-2025-44842

The TOTOLINK CA600-PoE outdoor wireless AP/CPE device, specifically version V5.3c.6665_B20180820 , contains a command injection vulnerability in the msg_process function. The root cause is a lack of proper filtering for special characters and commands within the Port parameter during request proc...

CVE-2025-44842: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44846

The TOTOLINK CA600-PoE router (version V5.3c.6665_B20180820 ) is vulnerable to a command injection vulnerability in the recvUpgradeNewFw function. The root cause is the lack of sufficient input sanitization when processing the fwUrl parameter. A remote attacker can exploit this by sending a speci...

CVE-2025-3995

A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /boafrm/fromStaticDHCP of the component LAN Settings Page. The manipulation of the argument Hostname leads to cross site...

CVE-2025-3996

A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /home.htm of the component MAC Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be...

CVE-2025-3994

A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been classified as problematic. Affected is an unknown function of the file /home.htm of the component IP Port Filtering. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attac...

CVE-2025-3993

A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525 and classified as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclos...

CVE-2025-3991

A vulnerability, which was classified as critical, was found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boafrm/formWdsEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-3992

A vulnerability has been found in TOTOLINK N150RT 3.4.0-B20190525 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWlwds. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been...