Unrated severityNVD Advisory· Published Apr 4, 2025· Updated Apr 4, 2025

TOTOLINK A6000R mtkwifi.lua apcli_cancel_wps command injection

CVE-2025-3249

Description

A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products

Totolink/A6000Rllm-create2 versions
= 1.0.1-B20201211.2000+ 1 more
- (no CPE)range: = 1.0.1-B20201211.2000
- (no CPE)range: 1.0.1-B20201211.2000

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/fjl1113/cve/blob/main/totolink.mdmitreexploit
vuldb.commitrethird-party-advisory
vuldb.commitresignaturepermissions-required
vuldb.commitrevdb-entrytechnical-description
www.totolink.netmitreproduct

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.005
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000