CVE-2025-6299
What it is
A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boa/formWSC. The manipulation of the argument targetAPSsid leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
At a glance
- Exploitability
- Can be exploited over the network with an admin-level account. Limited direct impact.
- Exploit odds
- 11.6% chance of exploitation in the next 30 days (EPSS). Higher than most.
- Fix
- No patch or advisory is linked yet. Look at mitigations or restrict exposure.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Details
- Published
- Last modified
- Exploit probability
- 11.6% · EPSS, next 30 days
- Weakness
- CWE-77 · Command injection
- Record status
- Analyzed
Affected
- Totolink n150rt Firmware 3.4.0-b20190525
Attack profile CVSS 4.0 · 2.0
- Attack vector
- Network
- Complexity
- Low
- Attack requirements
- None
- Privileges needed
- High
- User interaction
- None
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
