CVE-2025-6619: TOTOLINK CA300-PoE upgrade.so setUpgradeFW os command injection
A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function setUpgradeFW of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6619?
CVE-2025-6619 is classified as a critical vulnerability.
How does CVE-2025-6619 affect TOTOLINK CA300-PoE devices?
CVE-2025-6619 allows for remote OS command injection through the setUpgradeFW function in the upgrade.so file.
What can be the impact of exploiting CVE-2025-6619?
Exploitation of CVE-2025-6619 can lead to unauthorized command execution on affected TOTOLINK CA300-PoE devices.
How do I fix CVE-2025-6619?
To mitigate CVE-2025-6619, it is recommended to update to a patched version of TOTOLINK CA300-PoE firmware.
Is CVE-2025-6619 remotely exploitable?
Yes, CVE-2025-6619 can be exploited remotely, making it a significant security risk.