CVE-2025-4729: falha de média gravidade em TOTOLINK A3002R
TOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 1.2%
A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVEs relacionadas — TOTOLINK A3002R
No mesmo produto, das mais perigosas para as menos.
CVE-2025-6485MEDIUMTOTOLINK A3002R formWlSiteSurvey os command injectionEPSS 9.3%CVE-2025-6393HIGHTOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST Request formIPv6Addr buffer overflowEPSS 1.0%CVE-2025-6149HIGHTOTOLINK A3002R HTTP POST Request formSysLog buffer overflowEPSS 1.0%CVE-2025-6148HIGHTOTOLINK A3002RU HTTP POST Request formSysLog buffer overflowEPSS 1.0%CVE-2025-6487HIGHTOTOLINK A3002R formRoute stack-based overflowEPSS 1.0%CVE-2025-6486HIGHTOTOLINK A3002R formWlanMultipleAP stack-based overflowEPSS 1.0%