Command Injection Vulnerability in TOTOLINK CA300-POE by TOTOLINK
CVE-2025-44861

Currently unrated

Key Information:

Vendor

TOTOLINK
Status
CA300-POE
Vendor
CVE Published:
1 May 2025

What is CVE-2025-44861?

The TOTOLINK CA300-POE model has been identified with a command injection vulnerability within its CloudSrvUserdataVersionCheck function. Specifically, this flaw can be exploited through the url parameter, enabling attackers to execute arbitrary commands on the device by sending specially crafted requests. This vulnerability poses significant risks to device integrity and user data security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/Summermu/VulnForIoT/tree/main/Totolink...

EPSS Score

5% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.