PT-2025-21588 · Totolink · Totolink A3002Ru

Babyshark

·

Published

2025-05-15

·

Updated

2025-06-20

·

CVE-2025-4731

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R and A3002RU version 3.0.0-B20230809.1615
Description: A critical vulnerability has been found in the HTTP POST Request Handler component of TOTOLINK A3002R and A3002RU. This affects an unknown part of the file /boafrm/formPortFw. The manipulation of the service type argument leads to a buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Recommendations: As a temporary workaround, consider restricting access to the HTTP POST Request Handler component until a patch is available. Avoid using the service type argument in the affected HTTP POST Request Handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-05820
CVE-2025-4731

Affected Products

Totolink A3002Ru