CVE-2025-3249 — Injection in A6000r

CWE-74 — InjectionCWE-77 — Command Injection3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
7.2%
top 8.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink A6000rTotolink A6000r Firmware
Timeline
PublishedApr 4

Description

A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/a6000r1.0.1-B20201211.2000
▶NVDtotolink/a6000r_firmware1.0.1-b20201211.2000

🔴Vulnerability Details

2
GHSA
GHSA-37hr-3fmf-v449: A vulnerability classified as critical was found in TOTOLINK A6000R 1↗2025-04-04
▶
CVEList
TOTOLINK A6000R mtkwifi.lua apcli_cancel_wps command injection↗2025-04-04
▶
CVE-2025-3249 — Injection in Totolink A6000r | cvebase