CVE-2025-6621

2.1 lowEPSS 2.5%

Low (2.1) in totolink ca300-poe firmware. EPSS 2.5% chance of exploitation in the next 30 days.

A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.so. The manipulation of the argument hour/minute leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-77
Published: 2025-06-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

totolink:ca300-poe_firmware

References

https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md
https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md#poc
https://vuldb.com/?ctiid.313839
https://vuldb.com/?id.313839
https://vuldb.com/?submit.602266

Check your stack JSON