CVE-2025-6619
BaseFortify
Publication date: 2025-06-25
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | ca300-poe_firmware | 6.2c.884 |
| totolink | ca300-poe | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an OS command injection flaw in the TOTOLINK CA300-PoE router firmware version 6.2c.884. It exists in the setUpgradeFW function where the FileName parameter is not properly sanitized, allowing an attacker to remotely inject and execute arbitrary operating system commands on the device by manipulating this parameter. [1, 2]
How can this vulnerability impact me? :
The vulnerability allows remote attackers to execute arbitrary OS commands on the affected router without authentication. This can lead to unauthorized control over the device, compromising its confidentiality, integrity, and availability. Attackers could disrupt network operations, steal sensitive information, or use the device as a foothold for further attacks. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusual or suspicious requests targeting the setUpgradeFW function, especially those containing the FileName parameter with potentially malicious input. Since the vulnerability involves OS command injection via the FileName argument, detection could involve inspecting network traffic for exploit attempts or scanning the device for signs of unauthorized command execution. Specific commands are not provided in the resources, but network monitoring tools or intrusion detection systems configured to detect command injection patterns targeting the firmware upgrade process could be used. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected TOTOLINK CA300-PoE device running firmware version 6.2c.884 with an alternative product, as no known countermeasures or patches are documented. Limiting network exposure of the device, disabling remote firmware upgrade functionality if possible, and monitoring for exploit attempts are recommended to reduce risk until a fix is available. [2]