CVE-2025-6620

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884

Description: A critical issue affects the setUpgradeUboot function of the upgrade.so file, allowing os command injection through the manipulation of the FileName argument. This can be exploited remotely.

Recommendations: For TOTOLINK CA300-PoE version 6.2c.884, as a temporary workaround, consider disabling the setUpgradeUboot function until a patch is available. Restrict access to the upgrade.so file to minimize the risk of exploitation. Avoid using the FileName argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.