CVE-2025-44866

The Tenda W20E router (version 15.11.0.6 ) contains a command injection vulnerability within the formSetDebugCfg function. The flaw exists because the level parameter fails to properly filter command special characters, allowing an attacker to execute arbitrary commands via a crafted request. Whi...

CVE-2025-44846

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44854: Improper Neutralization of Special Elements used in a Command

TOTOLINK CP900 V6.3c.1144B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44865: Improper Neutralization of Special Elements used in a Command

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44839

The TOTOLINK CA600-PoE outdoor wireless AP/CPE (specifically version V5.3c.6665_B20180820 ) contains a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is a lack of sufficient control measures and filtering when processing the magicid parameter, whi...

PT-2025-18678 · Tenda · Tenda W20E

Name of the Vulnerable Software and Affected Versions: Tenda W20E version 15.11.0.6 Description: A command injection issue was found in the formSetDebugCfg function through the level parameter. This issue allows attackers to execute arbitrary commands via a manipulated request. Recommendations: F...

CVE-2025-44844: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44843: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44844

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44861

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44841

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-24522: Authentication Bypass by Primary Weakness

KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system...

CVE-2025-44838: Improper Neutralization of Special Elements used in a Command

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44847

The TOTOLINK CA600-PoE outdoor wireless AP/CPE device (firmware version V5.3c.6665_B20180820 ) contains a command injection vulnerability in the setWebWlanIdx function. The flaw exists because the software fails to properly filter special characters or commands within the webWlanIdx parameter dur...

CVE-2025-44861: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44862: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44854

The TOTOLINK CP900 wireless router, specifically version V6.3c.1144_B20190715 , contains a command injection vulnerability in the setUpgradeUboot function. The root cause is the lack of proper input sanitization for the FileName parameter, which allows an attacker to execute arbitrary commands by...

CVE-2025-44843

The TOTOLINK CA600-PoE outdoor wireless AP/CPE router is vulnerable to a command injection vulnerability in the CloudSrvUserdataVersionCheck function. The root cause is a lack of sufficient input validation for the url parameter , specifically failing to filter special characters and commands. A ...

CVE-2025-44842

The TOTOLINK CA600-PoE outdoor wireless AP/CPE device, specifically version V5.3c.6665_B20180820 , contains a command injection vulnerability in the msg_process function. The root cause is a lack of proper filtering for special characters and commands within the Port parameter during request proc...

CVE-2025-44837

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or magicid parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...