Totolink CA600-Poe Firmware vulnerabilities

10 CVEs affecting Totolink CA600-Poe Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-44848, published 2025-05-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-44843, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers…
CVE-2025-44847, published 2025-05-01. Medium severity, CVSS 6.3. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to…
CVE-2025-44846, published 2025-05-01. Medium severity, CVSS 6.3. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute…
CVE-2025-44848, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute…
CVE-2025-44845, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to…
CVE-2025-44844, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute…
CVE-2025-44842, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute…
CVE-2025-44841, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows…
CVE-2025-44840, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers…
CVE-2025-44839, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows…