CVE-2025-6618

2.1 lowEPSS 2.5%

Low (2.1) in totolink ca300-poe firmware. EPSS 2.5% chance of exploitation in the next 30 days.

A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified as critical. Affected is the function SetWLanApcliSettings of the file wps.so. The manipulation of the argument PIN leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-77
Published: 2025-06-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

totolink:ca300-poe_firmware

References

https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_44/44.md
https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_44/44.md#poc
https://vuldb.com/?ctiid.313836
https://vuldb.com/?id.313836
https://vuldb.com/?submit.602263

Check your stack JSON