CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44839

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44840

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44845

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44844

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44854

TOTOLINK CP900 V6.3c.1144B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44865

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44866

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44854

TOTOLINK CP900 V6.3c.1144B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

PT-2025-18666 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: The issue is related to a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This allows attackers to execute arbitrary commands via a crafte...

CVE-2025-44842

The TOTOLINK CA600-PoE outdoor wireless AP/CPE (version V5.3c.6665_B20180820 ) is vulnerable to a command injection vulnerability. The issue originates in the msg_process function because the Port parameter fails to properly filter special characters and commands. A remote attacker can exploit th...

CVE-2025-44846

The TOTOLINK CA600-PoE (version 5.3c.6665_B20180820 ) is vulnerable to a command injection vulnerability within the recvUpgradeNewFw function. The root cause is a failure to properly filter special characters and commands when processing the fwUrl parameter, allowing a remote attacker to execute ...

CVE-2025-44839

The TOTOLINK CA600-PoE (version 5.3c.6665_B20180820 ) contains a command injection vulnerability in the CloudSrvUserdataVersionCheck function. The root cause is a lack of control-level measures and failure to correctly filter command special characters when processing the magicid parameter. A rem...

CVE-2025-44848

The TOTOLINK CA600-PoE outdoor wireless AP/CPE, specifically version 5.3c.6665_B20180820 , is vulnerable to a command injection vulnerability in the msg_process function. The root cause is the lack of proper filtering for special characters and commands within the Url parameter, which allows an i...

CVE-2025-44837

The TOTOLINK CPE CP900 (version 6.3c.1144_B20190715 ) is susceptible to a command injection vulnerability within the CloudSrvUserdataVersionCheck function. The root cause is a lack of proper input sanitization when processing the url and magicid parameters. A remote attacker can exploit this by s...

CVE-2025-44865

The Tenda W20E router, specifically version 15.11.0.6 , is vulnerable to a command injection flaw within the formSetDebugCfg function. The vulnerability occurs because the enable parameter fails to properly filter shell metacharacters and commands, allowing an attacker to execute arbitrary comman...

CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44865

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44862

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...