CVE-2025-3249 is a medium severity (CVSS 6.3) command injection in the TOTOLINK A6000R router, firmware 1.0.1-B20201211.2000. The apcli_cancel_wps function in mtkwifi.lua passes input to a command unsafely. The record names no fix, so restrict management access and check TOTOLINK for newer firmware.
What's affected
TOTOLINK A6000R running firmware 1.0.1-B20201211.2000, per the CVE record. Other versions are not named, so check whether yours differs and what the vendor says.
The record points at the function apcli_cancel_wps in /usr/lib/lua/luci/controller/mtkwifi.lua and says the manipulation leads to command injection. It adds that the attack can be launched remotely, and that the exploit has been disclosed publicly and may be used. It does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
The vector requires low privileges, so a login to the router interface is part of the picture. That is why the score is medium, not high.
How to check if you're exposed
Open the router's administration page and read the firmware version under system status. Compare it with 1.0.1-B20201211.2000.
Check whether the management interface can be reached from the internet, and from guest or untrusted networks.
Look at the router's remote management setting and disable it if you do not need it. Also check for default credentials, which turn a low privilege requirement into no barrier at all.
What to do now
- Visit TOTOLINK's support site for the A6000R and install any newer firmware that addresses the issue.
- Disable remote management and restrict the admin page to a trusted wired port or VPN.
- Change the default administrator password to a long unique one.
- Segment the router from sensitive networks if you must keep the current firmware.
- Plan to replace devices that no longer receive firmware updates.
Why it matters
The classes are CWE-74 (Injection) and CWE-77 (Command Injection). The handler for cancelling a WPS client connection builds a command that includes a value from the request. Without separating data from the command, a crafted value can add commands of its own.
Router firmware commonly runs web handlers as the highest privileged user, so a command injection can mean full control of the device. A medium score here reflects the login requirement, not a small impact.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Is there a firmware fix?
The record does not name one. Check the vendor's support page for the A6000R and, until you find one, restrict access to the admin interface.
Sources
Last reviewed: 18 October 2026.
