CVE-2025-3249
Published: 04 April 2025
Summary
CVE-2025-3249 is a medium-severity Injection (CWE-74) vulnerability in Totolink A6000R Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical command injection vulnerability, tracked as CVE-2025-3249 and assigned CWE-74 and CWE-77, affects the TOTOLINK A6000R router running firmware 1.0.1-B20201211.2000. The flaw resides in the apcli_cancel_wps function within /usr/lib/lua/luci/controller/mtkwifi.lua, where unsanitized input allows arbitrary command execution.
An authenticated remote attacker can supply crafted parameters to the affected endpoint and execute operating-system commands on the device. The CVSS 5.3 vector reflects network attack reachability with low attack complexity and low privileges required, resulting in limited impacts to confidentiality, integrity, and availability on the target router.
Public references include a detailed proof-of-concept on GitHub and entries on VulDB, but no vendor advisory or firmware patch addressing the issue has been published by TOTOLINK. The associated EPSS score remains low, moving only modestly from 0.0637 to a peak of 0.0721.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9759
Vulnerability details
A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed…
more
to the public and may be used.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.