PT-2025-26307 · Totolink · Totolink A3002Ru

Yeleipeng

·

Published

2025-06-20

·

Updated

2025-08-01

·

CVE-2025-6337

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R and A3002RU versions 3.0.0-B20230809.1615 through 4.0.0-B20230531.1404
Description: A critical vulnerability has been found in the HTTP POST Request Handler of the affected devices. The issue is related to the manipulation of the submit-url argument, which leads to a buffer overflow. This can be exploited remotely. The exploit has been disclosed to the public.
Recommendations: For versions 3.0.0-B20230809.1615 through 4.0.0-B20230531.1404, consider disabling the HTTP POST Request Handler or restricting access to the /boafrm/formTmultiAP file until a patch is available. Avoid using the submit-url argument in the affected HTTP POST Request Handler to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-10003
CVE-2025-6337

Affected Products

Totolink A3002Ru