CVE-2025-6621: TOTOLINK CA300-PoE ap.so QuickSetting os command injection
A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.so. The manipulation of the argument hour/minute leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6621?
CVE-2025-6621 is classified as a critical severity vulnerability.
How does CVE-2025-6621 affect TOTOLINK CA300-PoE devices?
CVE-2025-6621 allows for OS command injection via the QuickSetting function in the ap.so file.
Can CVE-2025-6621 be exploited remotely?
Yes, CVE-2025-6621 can be exploited remotely by manipulating arguments related to time settings.
What are the potential impacts of CVE-2025-6621?
Exploitation of CVE-2025-6621 could lead to unauthorized command execution on affected TOTOLINK CA300-PoE devices.
How do I mitigate CVE-2025-6621?
To mitigate CVE-2025-6621, it is recommended to apply patches from TOTOLINK or follow security advisories for affected devices.