CVE-2025-4730: fallo de gravedad alta en TOTOLINK A3002R
TOTOLINK A3002R/A3002RU HTTP POST Request formMapDel buffer overflow
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.8%
A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVEs relacionadas — TOTOLINK A3002R
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-6485MEDIUMTOTOLINK A3002R formWlSiteSurvey os command injectionEPSS 9.3%CVE-2025-4729MEDIUMTOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injectionEPSS 1.2%CVE-2025-6393HIGHTOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST Request formIPv6Addr buffer overflowEPSS 1.0%CVE-2025-6149HIGHTOTOLINK A3002R HTTP POST Request formSysLog buffer overflowEPSS 1.0%CVE-2025-6148HIGHTOTOLINK A3002RU HTTP POST Request formSysLog buffer overflowEPSS 1.0%CVE-2025-6487HIGHTOTOLINK A3002R formRoute stack-based overflowEPSS 1.0%