CVE-2025-52046

Totolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and desc parameters. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

5.31% chance of exploitation in the next 30 days, 93rd percentile

Published

2025-07-17

Updated

2025-09-15

Proof-of-concept exploits (1)

• w0rkd4tt/Totolink/blob/main/CVE-2025-52046/CVE-2025-52046.md2★ · 2025-10-01

Security advisories

• https://www.notion.so/setWiFiAclRules-A3300R-2108aff2dc8b80348d94e7fd1378d475?source=copy…

References

• CVE Record
• NVD entry

Related

• CVE-2025-52053