CVE-2025-44846

The TOTOLINK CA600-PoE router (version V5.3c.6665_B20180820 ) is vulnerable to a command injection vulnerability in the recvUpgradeNewFw function. The root cause is the lack of sufficient input sanitization when processing the fwUrl parameter. A remote attacker can exploit this by sending a speci...

CVE-2025-44836

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44867

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44847: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44866

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

TOTOLINK CA300-PoE 安全漏洞

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the msgprocess function Url parameter failing to correctly filter constructive command special characters, commands, etc., which...

CVE-2025-44860: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44864

The Tenda W20E router, specifically version 15.11.0.6 , is susceptible to a command injection vulnerability in the formSetDebugCfg function. The root cause is the failure of the module parameter to properly filter constructor command special characters and other commands. This oversight allows an...

CVE-2025-44863: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44848

The TOTOLINK CA600-PoE outdoor wireless AP/CPE device, specifically version V5.3c.6665_B20180820 , is vulnerable to a command injection flaw in the msg_process function. The root cause is the lack of adequate filtering for special characters and commands within the Url parameter during request pr...

CVE-2025-44842

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44843

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44836

The TOTOLINK CPE CP900 router (specifically version V6.3c.1144_B20190715 ) is vulnerable to a command injection flaw within the setApRebootScheCfg function. The root cause is the lack of proper input cleaning and filtering for hour and minute parameters, which allows an intruder to execute arbitr...

CVE-2025-44838

The TOTOLINK CPE CP900 (specifically firmware version V6.3c.1144_B20190715 ) is vulnerable to a command injection flaw within the setUploadUserData function. The root cause is a lack of proper input sanitization or filtering for special characters when processing the FileName parameter. This allo...

CVE-2025-44865

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44837

The TOTOLINK CPE CP900 (firmware version V6.3c.1144_B20190715 ) is vulnerable to a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is the lack of proper sanitization for input data when processing the url and magicid parameters. A remote attacker c...

CVE-2025-44863

The TOTOLINK CA300-POE wireless access point (version 6.2c.884_B20180522 ) contains a command injection vulnerability in the msg_process function. The root cause is the failure to correctly filter special characters and commands within the Url parameter. A remote attacker can exploit this by send...

CVE-2025-44848

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...