CVE-2025-6618: Totolink CA300-PoE Firmware RCE Flaw

CVE-2025-6618 Overview

A critical OS command injection vulnerability has been identified in TOTOLINK CA300-PoE firmware version 6.2c.884. The vulnerability exists in the SetWLanApcliSettings function within the wps.so library file, where improper handling of the PIN argument allows attackers to inject arbitrary operating system commands. This network-accessible vulnerability can be exploited remotely by authenticated attackers, potentially leading to complete device compromise.

Critical Impact

Remote attackers with low-privilege access can execute arbitrary OS commands on affected TOTOLINK CA300-PoE devices, potentially gaining full control over the networking infrastructure and using compromised devices as pivot points for lateral movement.

Affected Products

• TOTOLINK CA300-PoE Firmware version 6.2c.884
• TOTOLINK CA300-PoE Hardware Device

Discovery Timeline

• 2025-06-25 - CVE-2025-6618 published to NVD
• 2025-06-27 - Last updated in NVD database

Technical Details for CVE-2025-6618

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-77 (Improper Neutralization of Special Elements used in a Command). The SetWLanApcliSettings function in the wps.so shared library file fails to properly sanitize user-supplied input in the PIN parameter before incorporating it into operating system command execution.

When a user provides a malicious PIN value containing shell metacharacters or command separators, the function directly passes this input to a system command without proper escaping or validation. This allows attackers to break out of the intended command context and execute arbitrary commands with the privileges of the web server process, typically root on embedded devices like the CA300-PoE.

The exploit has been publicly disclosed, increasing the urgency for organizations to address this vulnerability. Technical details and proof-of-concept information are available through the GitHub PoC Repository.

Root Cause

The root cause is insufficient input validation and sanitization in the SetWLanApcliSettings function. The PIN parameter, which is intended to accept WPS PIN values, is passed directly to shell command execution without proper escaping of special characters. This violates secure coding practices for handling user input in contexts where command injection is possible.

Attack Vector

The attack can be launched remotely over the network. An authenticated attacker with low-privilege access to the device's web management interface can craft a malicious HTTP request containing shell metacharacters in the PIN parameter. When the SetWLanApcliSettings function processes this request, the injected commands are executed on the underlying operating system.

The vulnerability mechanism involves sending a crafted request to the wireless LAN AP client settings endpoint with a specially formatted PIN value containing command injection payloads. Common techniques include using semicolons, pipes, backticks, or $(command) syntax to chain additional commands. Upon processing, the device executes the attacker's arbitrary commands with elevated privileges typical of embedded IoT devices.

For detailed exploitation information, refer to the PoC documentation published by security researchers.

Detection Methods for CVE-2025-6618

Indicators of Compromise

• Unusual HTTP requests to wireless configuration endpoints containing shell metacharacters such as ;, |, $(), or backticks in parameter values
• Unexpected processes spawning from the web server or wps.so library process
• Outbound network connections from the device to unknown external IP addresses
• Modifications to system files or creation of new user accounts on the device
• Presence of reverse shell processes or unauthorized SSH/telnet sessions

Detection Strategies

• Monitor web server access logs for requests to wireless settings endpoints containing suspicious characters in the PIN parameter
• Implement network-based intrusion detection rules to identify command injection patterns in HTTP traffic destined for TOTOLINK devices
• Deploy endpoint detection and response (EDR) solutions capable of monitoring process execution on network devices
• Establish baseline behavior for the device and alert on anomalous outbound connections or process activity

Monitoring Recommendations

• Enable verbose logging on the TOTOLINK device management interface and forward logs to a centralized SIEM
• Configure network monitoring to alert on traffic anomalies from IoT/network device segments
• Implement periodic integrity checks on device firmware and configuration files
• Monitor for DNS queries or network connections to known malicious infrastructure originating from network devices

How to Mitigate CVE-2025-6618

Immediate Actions Required

• Restrict network access to the TOTOLINK CA300-PoE management interface using firewall rules or network segmentation
• Disable remote management access if not required for operations
• Place affected devices behind a VPN or implement strong access controls for administrative interfaces
• Monitor affected devices for signs of compromise and isolate any suspicious devices immediately
• Review and audit user accounts with access to device administration

Patch Information

No official patch has been announced by TOTOLINK at this time. Organizations should monitor the TOTOLINK Official Site for firmware updates addressing this vulnerability. Additional vulnerability details are available through VulDB #313836.

Workarounds

• Implement network-level access controls to restrict management interface access to trusted IP addresses only
• Deploy a web application firewall (WAF) or reverse proxy to filter malicious input before it reaches the device
• Disable WPS functionality if not required, as the vulnerable function is related to WPS settings
• Consider replacing affected devices with alternatives from vendors that provide timely security updates
• Implement network segmentation to isolate IoT and network infrastructure devices from critical systems

# Example: Restrict management access using iptables on upstream device
# Allow management access only from trusted admin network
iptables -A FORWARD -d <TOTOLINK_IP> -p tcp --dport 80 -s 192.168.100.0/24 -j ACCEPT
iptables -A FORWARD -d <TOTOLINK_IP> -p tcp --dport 443 -s 192.168.100.0/24 -j ACCEPT
iptables -A FORWARD -d <TOTOLINK_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <TOTOLINK_IP> -p tcp --dport 443 -j DROP