CVE-2025-4731

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-4731
A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type/ip_subnet leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS

No CVSS.

References
Link Resource
https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/4.md Broken Link
https://vuldb.com/?ctiid.309033 Permissions Required VDB Entry
https://vuldb.com/?id.309033 Third Party Advisory VDB Entry
https://vuldb.com/?submit.570688 Third Party Advisory VDB Entry
https://www.totolink.net/ Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:totolink:a3002r_firmware:3.0.0-b20230809.1615:*:*:*:*:*:*:*
cpe:2.3:h:totolink:a3002r:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:totolink:a3002ru_firmware:3.0.0-b20230809.1615:*:*:*:*:*:*:*
cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*
History

20 Jun 2025, 14:09

Type Values Removed Values Added
CPE cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:a3002ru_firmware:3.0.0-b20230809.1615:*:*:*:*:*:*:*
cpe:2.3:o:totolink:a3002r_firmware:3.0.0-b20230809.1615:*:*:*:*:*:*:*
cpe:2.3:h:totolink:a3002r:-:*:*:*:*:*:*:*
First Time Totolink a3002ru Firmware
Totolink a3002r Firmware
Totolink a3002r
Totolink
Totolink a3002ru
References () https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/4.md - () https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/4.md - Broken Link
References () https://vuldb.com/?ctiid.309033 - () https://vuldb.com/?ctiid.309033 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.309033 - () https://vuldb.com/?id.309033 - Third Party Advisory, VDB Entry
References () https://www.totolink.net/ - () https://www.totolink.net/ - Product
References () https://vuldb.com/?submit.570688 - () https://vuldb.com/?submit.570688 - Third Party Advisory, VDB Entry

16 May 2025, 16:15

Type Values Removed Values Added
CWE CWE-120
CWE-119
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : unknown
Summary A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type/ip_subnet leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

16 May 2025, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-16 00:15

Updated : 2025-06-20 14:09

NVD link : CVE-2025-4731

Mitre link : CVE-2025-4731

JSON object : View

Products Affected

totolink

  • a3002ru_firmware
  • a3002r
  • a3002r_firmware
  • a3002ru
CWE

No CWE.