CVE-2025-6620 is a medium severity (CVSS 6.3) OS command injection in the TOTOLINK CA300-PoE access point, firmware 6.2c.884. The setUpgradeUboot function in upgrade.so passes the FileName argument to a shell. The record says an exploit is public and names no fix, so restrict the management interface.
What's affected
- Product: TOTOLINK CA300-PoE, a PoE wireless access point, firmware 6.2c.884.
- Affected function: setUpgradeUboot in upgrade.so, argument FileName.
- Fixed: no fixed firmware is named in the record or in the public write-up we read. Check the TOTOLINK site and support channels for current firmware.
- Severity: CVSS 6.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The record says the attack can be launched remotely and needs a low privilege account on the device.
The record says the exploit has been disclosed to the public and may be used. The record text calls the issue critical in the reporting database own wording, while the CVSS base score is medium, so rely on the score and on your own exposure.
How to check if you're exposed
There is no package manager to query on an access point. Work from the device and the network.
- Log in to the device or its controller and read the firmware version. Compare it with 6.2c.884.
- Find out whether the web management interface is reachable from the internet or from guest and user networks. Look at firewall rules and any port forwarding.
- Review which accounts exist on the device, and whether the default password was changed, because the record says a low privilege login is needed.
A unit that is only reachable from a locked down management network is far less exposed than one that answers on a public address.
What to do now
- Make sure the management interface is not reachable from the internet, guest Wi-Fi or user networks. Use a dedicated management VLAN or a VPN.
- Change any default password on the device and remove accounts you do not recognize.
- Check the TOTOLINK support site for newer firmware for the CA300-PoE and apply it if one lists a fix for this issue. The record does not name one.
- If no fix is available and you cannot isolate the device, plan to replace it with a supported model.
- Keep a list of every network device with its firmware version. A free in-browser scan at gold.safeguard.sh/scan covers your open source dependencies, and reachability analysis helps you rank which findings sit on code that actually runs.
Why it matters
The class is CWE-77, CWE-78: CWE-78 is OS command injection and CWE-77 is the broader command injection class. The record says the FileName value is used in the setUpgradeUboot function and ends up in a command. When a device builds a shell command from a field, special characters in the field can add commands, and devices of this kind usually run their web service with high privileges.
This is one of several command injection reports against the same firmware, from the same public research repository, including CVE-2025-6618, CVE-2025-6619 and CVE-2025-6621. A family of reports like this suggests the code base needs a broad review, so fixing one function is rarely the end of it. The record does not mark this as exploited in the wild beyond the public disclosure, and it is not on CISA KEV.
Quick check
Do attackers need a login?
The record vector lists low privileges, so an account on the device is needed.
Is there a firmware fix?
None is named in the record or in the write-up we read. Check the vendor and plan around that.
Sources
Last reviewed: 18 October 2026.
