CVE-2025-6620

KRITISCH 9.8CVE-2025-6620 · Published 25/06/2025 · updated 17/06/2026

Kurz gesagt

CVE-2025-6620 ist eine Schwachstelle (KRITISCH (CVSS 9.8)).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.5%, höher als bei 84.8% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as critical. Affected by this issue is the function setUpgradeUboot of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

References

wudipjq/my_vuln · Exploit
wudipjq/my_vuln · Exploit
vuldb.com · Permissions Required
vuldb.com · Third Party Advisory
vuldb.com · Third Party Advisory
totolink.net · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free