CVE-2025-44838

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44843

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44844

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44842

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44840

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44841

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44839

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44848

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44844

The TOTOLINK CA600-PoE (version V5.3c.6665_B20180820 ) contains a command injection vulnerability within the setUpgradeFW() function. The root cause is a failure to properly filter or sanitize special characters and commands in the FileName parameter during processing. A remote attacker can explo...

CVE-2025-44864: Improper Neutralization of Special Elements used in a Command

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44863: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44860: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44847: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44836

The TOTOLINK CPE CP900 router (specifically version V6.3c.1144_B20190715 ) is vulnerable to a command injection flaw within the setApRebootScheCfg function. The root cause is the lack of proper input cleaning and filtering for hour and minute parameters, which allows an intruder to execute arbitr...

CVE-2025-44866

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

TOTOLINK CA300-PoE security vulnerability

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the msgprocess function Url parameter failing to correctly filter constructive command special characters, commands, etc., which...

TOTOLINK CA300-PoE security vulnerability

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. The TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the failure of the msgprocess function Port parameter to correctly filter constructed command special characters, commands,...

CVE-2025-44861

The TOTOLINK CA300-PoE wireless access point (firmware version V6.2c.884_B20180522 ) is susceptible to a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is a lack of proper input validation and filtering for special characters within the url parame...

CVE-2025-44838

The TOTOLINK CPE CP900 (specifically firmware version V6.3c.1144_B20190715 ) is vulnerable to a command injection flaw within the setUploadUserData function. The root cause is a lack of proper input sanitization or filtering for special characters when processing the FileName parameter. This allo...

CVE-2025-44841

The TOTOLINK CA600-PoE (V5.3c.6665_B20180820) router is affected by a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is a lack of proper input validation and filtering for special characters, commands, and other elements within the version paramet...