CVE-2025-4733: high-severity vulnerability in TOTOLINK A3002R
TOTOLINK A3002R/A3002RU HTTP POST Request formIpQoS buffer overflow
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.8%
A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects some unknown processing of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Related CVEs — TOTOLINK A3002R
In the same product, most dangerous first.
CVE-2025-6485MEDIUMTOTOLINK A3002R formWlSiteSurvey os command injectionEPSS 9.3%CVE-2025-4729MEDIUMTOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injectionEPSS 1.2%CVE-2025-6393HIGHTOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST Request formIPv6Addr buffer overflowEPSS 1.0%CVE-2025-6149HIGHTOTOLINK A3002R HTTP POST Request formSysLog buffer overflowEPSS 1.0%CVE-2025-6148HIGHTOTOLINK A3002RU HTTP POST Request formSysLog buffer overflowEPSS 1.0%CVE-2025-6487HIGHTOTOLINK A3002R formRoute stack-based overflowEPSS 1.0%