CVE-2025-6485: fallo de gravedad media en TOTOLINK A3002R
TOTOLINK A3002R formWlSiteSurvey os command injection
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
35Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck.
ssvc Attendcvss 5.3epss 9.3%
de la publicación al arma
Publicada en NVD22 jun
VulnCheck+214d
A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critical. This affects the function formWlSiteSurvey of the file /boafrm/formWlSiteSurvey. The manipulation of the argument wlanif leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
TOTOLINK · A3002RCVEs relacionadas — TOTOLINK A3002R
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-4729MEDIUMTOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injectionEPSS 1.2%CVE-2025-6393HIGHTOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST Request formIPv6Addr buffer overflowEPSS 1.0%CVE-2025-6149HIGHTOTOLINK A3002R HTTP POST Request formSysLog buffer overflowEPSS 1.0%CVE-2025-6487HIGHTOTOLINK A3002R formRoute stack-based overflowEPSS 1.0%CVE-2025-6486HIGHTOTOLINK A3002R formWlanMultipleAP stack-based overflowEPSS 1.0%CVE-2025-6337HIGHTOTOLINK A3002R/A3002RU HTTP POST Request formTmultiAP buffer overflowEPSS 1.0%