CVE-2025-44847

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44862

The TOTOLINK CA300-POE router (specifically version V6.2c.884_B20180522 ) contains a command injection vulnerability within the recvUpgradeNewFw function. The root cause is the failure to properly sanitize or filter special characters and commands within the fwUrl parameter during data processing...

CVE-2025-44846

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44867

The Tenda W20E router, specifically version V15.11.0.6 , is vulnerable to a command injection vulnerability (CWE-77) within the formSetNetCheckTools function. The root cause is the hostName parameter failing to correctly filter special characters and commands, which allows an attacker to execute ...

CVE-2025-44840

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44840

The TOTOLINK CA600-PoE outdoor wireless AP/CPE (specifically version V5.3c.6665_B20180820 ) is susceptible to a command injection vulnerability in the CloudSrvUserdataVersionCheck function. The flaw exists because the svn parameter fails to properly filter special characters and commands during p...

CVE-2025-44861

The TOTOLINK CA300-PoE wireless access point (firmware version V6.2c.884_B20180522 ) is susceptible to a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is a lack of proper input validation and filtering for special characters within the url parame...

CVE-2025-44840

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44848

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

TOTOLINK CA300-PoE 安全漏洞

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. The TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the failure of the msgprocess function Port parameter to correctly filter constructed command special characters, commands,...

CVE-2025-44844

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44842

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44860

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44841

The TOTOLINK CA600-PoE (V5.3c.6665_B20180820) router is affected by a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is a lack of proper input validation and filtering for special characters, commands, and other elements within the version paramet...

CVE-2025-44836

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44860

The TOTOLINK CA300-POE wireless access point (firmware version V6.2c.884_B20180522 ) is vulnerable to a command injection vulnerability in the msg_process function. The flaw exists because the Port parameter fails to properly filter command special characters or other injected commands. A remote ...

CVE-2025-44843

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44854

TOTOLINK CP900 V6.3c.1144B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44846

The TOTOLINK CA600-PoE router (version V5.3c.6665_B20180820 ) is vulnerable to a command injection vulnerability in the recvUpgradeNewFw function. The root cause is the lack of sufficient input sanitization when processing the fwUrl parameter. A remote attacker can exploit this by sending a speci...

CVE-2025-44836

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...