CVE DATABASE / CVE-2025-44844

CVE-2025-44844

CVSS 6.5 · MEDIUM

Summary

TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

CVSS 3.1 breakdown

Base score	6.5 (MEDIUM)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector	NETWORK
Attack complexity	LOW
Privileges required	NONE
User interaction	NONE
Scope	UNCHANGED
Confidentiality	LOW
Integrity	LOW
Availability	NONE

Weakness type (CWE)

CWE-77

Affected products

Totolink ca600-poe firmwareTotolink ca600-poe

Check this CVE live

Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.

References

https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA600-PoE/setUpgradeFW/readme.md

Data: NIST NVD. NVD last modified 2025-05-22. Always verify against the vendor advisory before acting.