Command Injection Vulnerability in TOTOLINK CA300-POE by TOTOLINK
CVE-2025-44861

Currently unrated

Key Information:

Vendor

TOTOLINK
Status
CA300-POE
Vendor
CVE Published:
1 May 2025

What is CVE-2025-44861?

The TOTOLINK CA300-POE model has been identified with a command injection vulnerability within its CloudSrvUserdataVersionCheck function. Specifically, this flaw can be exploited through the url parameter, enabling attackers to execute arbitrary commands on the device by sending specially crafted requests. This vulnerability poses significant risks to device integrity and user data security.

References

https://github.com/Summermu/VulnForIoT/tree/main/Totolink...

EPSS Score

15% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.