CVE-2025-3249 - TOTOLINK A6000R mtkwifi.lua apcli_cancel_wps command injection

Back Back to CVE browser

MEDIUM

TOTOLINK A6000R mtkwifi.lua apcli_cancel_wps command injection

Published Apr 4, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 2.76%

Description

A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products

Vendor TOTOLINK Product n/a Default
n/a
- Version
  1.0.1-B20201211.2000
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TOTOLINK

n/a

Version	Status	Constraints
1.0.1-B20201211.2000	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-77

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-9759
Advisory
https://github.com/fjl1113/cve/blob/main/totolink.md
exploitBroken LinkThird Party Advisory
https://vuldb.com/?ctiid.303319
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.303319
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.543214
third-party-advisoryThird Party AdvisoryVDB Entry
https://www.totolink.net/
product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-9759		Advisory
https://github.com/fjl1113/cve/blob/main/totolink.md		exploitBroken LinkThird Party Advisory
https://vuldb.com/?ctiid.303319		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.303319		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.543214		third-party-advisoryThird Party AdvisoryVDB Entry
https://www.totolink.net/		product