CVE-2025-6620

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as critical. Affected by this issue is the function setUpgradeUboot of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
TOTOLINK	CA300-PoE	6.2c.884

References

https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.mdExploit, Third Party Advisory
https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.313838Permissions Required, VDB Entry
https://vuldb.com/?id.313838Third Party Advisory, VDB Entry
https://vuldb.com/?submit.602265Third Party Advisory, VDB Entry
https://www.totolink.net/Product
https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.mdExploit, Third Party Advisory
https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.md#pocExploit, Third Party Advisory

Timeline

Published: Jun 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-662005.4mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directi CVE-2025-662018.1LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (S CVE-2025-662026.5Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass pa CVE-2025-662039.1StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the str CVE-2025-662048.1WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the CVE-2025-662059.8Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injecti CVE-2025-662068.6Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, CVE-2025-662089.8Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabor CVE-2025-662098.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an auth CVE-2025-66219.8A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.CVE-2025-662108.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an auth CVE-2025-662118.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an auth