CVE-2025-6619
📋 TL;DR
This critical vulnerability in TOTOLINK CA300-PoE routers allows remote attackers to execute arbitrary operating system commands by manipulating the FileName parameter in the firmware upgrade function. Attackers can exploit this to gain full control of affected devices. All users of TOTOLINK CA300-PoE routers running version 6.2c.884 are affected.
💻 Affected Systems
- TOTOLINK CA300-PoE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent backdoor installation, network traffic interception, lateral movement to other devices, and use as botnet node.
Likely Case
Remote code execution leading to device takeover, credential theft, and network reconnaissance.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept exploit available on GitHub. Remote exploitation requires no authentication. Simple command injection via FileName parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check TOTOLINK website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload new firmware file. 6. Wait for automatic restart.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Network segmentation
allIsolate affected routers in separate VLAN with strict firewall rules
🧯 If You Can't Patch
- Block inbound access to router management interface (typically port 80/443) at network perimeter
- Implement strict network segmentation to limit router access to authorized management systems only
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface. If version is 6.2c.884, device is vulnerable.Check Version:
Check via web interface at http://[router-ip]/ or using curl: curl -s http://[router-ip]/login.cgi | grep versionVerify Fix Applied:
After firmware update, verify version number has changed from 6.2c.884 in admin interface.📡 Detection & Monitoring
Log Indicators:
- Unusual firmware upgrade attempts
- Suspicious commands in system logs
- Multiple failed upgrade attempts
Network Indicators:
- Unusual outbound connections from router
- Traffic to suspicious IPs
- Unexpected firmware download attempts
SIEM Query:
source="router_logs" AND ("upgrade.so" OR "setUpgradeFW" OR "FileName") AND command="*;*" OR command="*|*" OR command="*`*"🔗 References
- https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md
- https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md#poc
- https://vuldb.com/?ctiid.313837
- https://vuldb.com/?id.313837
- https://vuldb.com/?submit.602264
- https://www.totolink.net/
- https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md
- https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md#poc
