CVE-2025-6621
📋 TL;DR
This critical vulnerability in TOTOLINK CA300-PoE routers allows remote attackers to execute arbitrary operating system commands by manipulating time parameters (hour/minute) in the QuickSetting function. Attackers can gain full control of affected devices, potentially compromising network security. All users of TOTOLINK CA300-PoE routers running version 6.2c.884 are affected.
💻 Affected Systems
- TOTOLINK CA300-PoE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Router compromise allowing traffic interception, credential theft, and use as attack platform for further network exploitation.
If Mitigated
Limited impact if device is isolated, has strict network controls, and command injection attempts are blocked.
🎯 Exploit Status
Public proof-of-concept available on GitHub demonstrates remote command injection. Simple exploitation makes weaponization likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check TOTOLINK website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Network Isolation
allRemove affected routers from internet-facing positions and place behind firewalls
Access Restriction
allImplement strict network access controls to limit who can reach router management interface
🧯 If You Can't Patch
- Immediately disconnect affected routers from internet and critical networks
- Implement strict egress filtering to prevent compromised devices from reaching external command-and-control servers
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is 6.2c.884, device is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware Information pageVerify Fix Applied:
After firmware update, verify version number has changed from 6.2c.884 and test QuickSetting functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual commands in system logs
- Multiple failed authentication attempts to router interface
- Suspicious process execution
Network Indicators:
- Unexpected outbound connections from router
- Traffic to known malicious IPs
- Unusual port activity
SIEM Query:
source="router_logs" AND ("os command" OR "shell" OR "exec" OR suspicious_command_pattern)🔗 References
- https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md
- https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md#poc
- https://vuldb.com/?ctiid.313839
- https://vuldb.com/?id.313839
- https://vuldb.com/?submit.602266
- https://www.totolink.net/
- https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md
- https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md#poc
