CVE-2025-44837

Vulnerability

A command injection vulnerability exists in the CloudSrvUserdataVersionCheck function of TOTOLINK CPE CP900 firmware version V6.3c.1144_B20190715. The vulnerability is triggered via the url or magicid parameters, which are not properly sanitized before being used in a system command [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted POST request to /cgi-bin/cstecgi.cgi with the topicurl set to CloudSrvUserdataVersionCheck and injecting arbitrary commands into the url or magicid parameters. No authentication is required, and the attacker only needs network access to the device [1].

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the device with the privileges of the web server, typically root. This can lead to full compromise of the device, including data exfiltration, further network attacks, or device disruption.

Mitigation

As of the publication date, no official fix or patch has been released by TOTOLINK. Users should restrict network access to the device's web interface and monitor for firmware updates. The device may be at end of life, so upgrading to a supported model may be advisable.