PT-2020-16101 · Totolink · Totolink A3002Ru

Published 2020-12-09 · Updated 2025-01-23 · CVE-2020-25499

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 2.0.0 B20190814.1034

Description The issue allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.

Recommendations For TOTOLINK A3002RU version 2.0.0 B20190814.1034, consider disabling the 'Run Command' functionality until a patch is available to prevent the execution of arbitrary OS commands. Restrict access to the router to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

OS Command Injection

Weakness Enumeration

CWE-862

CWE-78

Related Identifiers

CVE-2020-25499

Affected Products

Totolink A3002Ru

References · 13

• 🔥 https://github.com/kdoos/Vulnerabilities/blob/main/RCE_TOTOLINK-A3002RU-V2 · Exploit
• https://osv.dev/vulnerability/CVE-2020-25499 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25499 · Security Note
• https://totolink.net/home/index/newsss/id/196.html · Vendor Advisory
• https://t.me/cibsecurity/18363 · Telegram Post
• https://t.me/aptreports/15229 · Telegram Post
• https://t.me/cibsecurity/18324 · Telegram Post
• https://t.me/cibsecurity/18383 · Telegram Post
• https://t.me/cvenotify/6894 · Telegram Post
• https://t.me/true_secator/6651 · Telegram Post
• https://t.me/cibsecurity/18343 · Telegram Post
• https://t.me/aptreports/15336 · Telegram Post
• https://t.me/cibsecurity/18304 · Telegram Post