PT-2025-26563 · Totolink · Totolink A3002Ru

Pjq123

·

Published

2025-06-19

·

Updated

2025-08-14

·

CVE-2025-6485

CVSS v2.0

6.5

Medium

VectorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 1.1.1-B20200824.0128
Description: A critical issue affects the function formWlSiteSurvey of the file /boafrm/formWlSiteSurvey. The manipulation of the argument wlanif leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Recommendations: As a temporary workaround, consider disabling the formWlSiteSurvey function until a patch is available. Restrict access to the /boafrm/formWlSiteSurvey file to minimize the risk of exploitation. Avoid using the argument wlanif in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

BDU:2025-07793
CVE-2025-6485

Affected Products

Totolink A3002Ru