CVE-2025-3249
📋 TL;DR
This critical vulnerability in TOTOLINK A6000R routers allows remote attackers to execute arbitrary commands via command injection in the apcli_cancel_wps function. Attackers can exploit this to gain unauthorized access and control of affected devices. Only TOTOLINK A6000R routers running firmware version 1.0.1-B20201211.2000 are affected.
💻 Affected Systems
- TOTOLINK A6000R
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, intercept network traffic, pivot to internal networks, or use the device for botnet activities.
Likely Case
Remote code execution leading to device takeover, credential theft, and potential lateral movement within the network.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable. The vulnerability requires no authentication and has simple exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.totolink.net/
Restart Required: Yes
Instructions:
1. Check TOTOLINK website for firmware updates
2. Download latest firmware for A6000R
3. Access router admin interface
4. Navigate to firmware upgrade section
5. Upload and apply new firmware
6. Reboot router after update completes
🔧 Temporary Workarounds
Disable WPS functionality
allDisable Wi-Fi Protected Setup (WPS) feature to remove the vulnerable code path
Access router admin interface -> Wireless Settings -> Disable WPS
Restrict web interface access
linuxLimit access to router administration interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious outbound connections from router IP
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Information. If version is exactly 1.0.1-B20201211.2000, device is vulnerable.Check Version:
curl -s http://router-ip/cgi-bin/luci/ | grep -i firmware || ssh admin@router-ip 'cat /etc/openwrt_release'Verify Fix Applied:
After firmware update, verify version has changed from 1.0.1-B20201211.2000. Test WPS functionality to ensure it works without errors.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/luci with WPS-related parameters
- Command execution patterns in system logs
- Failed authentication attempts followed by successful WPS operations
Network Indicators:
- Unexpected outbound connections from router IP
- Traffic to known malicious IPs from router
- Port scanning originating from router
SIEM Query:
source="router.log" AND ("apcli_cancel_wps" OR "WPS" OR "command injection") AND status="200"