Details of VAR-202504-0694

ID

VAR-202504-0694

CVE

CVE-2025-3249

TITLE

TOTOLINK of a6000r Injection Vulnerability in Firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-005961

DESCRIPTION

A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. TOTOLINK of a6000r The firmware contains injection and command injection vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK A6000R is a wireless router with excellent performance. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2025-3249 // JVNDB: JVNDB-2025-005961 // CNVD: CNVD-2025-12086

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-12086

AFFECTED PRODUCTS

vendor:	totolink	model:	a6000r	scope:	eq	version:	1.0.1-b20201211.2000	Trust: 1.0
vendor:	totolink	model:	a6000r	scope:	eq	version:	a6000r firmware 1.0.1-b20201211.2000	Trust: 0.8
vendor:	totolink	model:	a6000r	scope:	eq	version:	-	Trust: 0.8
vendor:	totolink	model:	a6000r	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a6000r 1.0.1-b20201211.2000	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-12086 // JVNDB: JVNDB-2025-005961 // NVD: CVE-2025-3249

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-3249
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2025-3249
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2025-005961
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2025-12086
value:	MEDIUM
Trust: 0.6

cna@vuldb.com:	CVE-2025-3249
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-005961
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2025-12086
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2025-3249
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2025-3249
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2025-005961
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-12086 // JVNDB: JVNDB-2025-005961 // NVD: CVE-2025-3249 // NVD: CVE-2025-3249

PROBLEMTYPE DATA

problemtype:	CWE-77	Trust: 1.0
problemtype:	CWE-74	Trust: 1.0
problemtype:	injection (CWE-74) [ others ]	Trust: 0.8
problemtype:	Command injection (CWE-77) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-005961 // NVD: CVE-2025-3249

EXTERNAL IDS

db:	NVD	id:	CVE-2025-3249	Trust: 3.2
db:	VULDB	id:	303319	Trust: 2.4
db:	JVNDB	id:	JVNDB-2025-005961	Trust: 0.8
db:	CNVD	id:	CNVD-2025-12086	Trust: 0.6

sources: CNVD: CNVD-2025-12086 // JVNDB: JVNDB-2025-005961 // NVD: CVE-2025-3249

REFERENCES

url:	https://vuldb.com/?id.303319	Trust: 2.4
url:	https://vuldb.com/?submit.543214	Trust: 2.4
url:	https://www.totolink.net/	Trust: 2.4
url:	https://vuldb.com/?ctiid.303319	Trust: 1.6
url:	https://github.com/fjl1113/cve/blob/main/totolink.md	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2025-3249	Trust: 0.8

sources: CNVD: CNVD-2025-12086 // JVNDB: JVNDB-2025-005961 // NVD: CVE-2025-3249

SOURCES

db:	CNVD	id:	CNVD-2025-12086
db:	JVNDB	id:	JVNDB-2025-005961
db:	NVD	id:	CVE-2025-3249

LAST UPDATE DATE

2025-06-15T23:39:20.174000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-12086	date:	2025-06-11T00:00:00
db:	JVNDB	id:	JVNDB-2025-005961	date:	2025-05-29T06:52:00
db:	NVD	id:	CVE-2025-3249	date:	2025-05-28T15:15:07.290

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-12086	date:	2025-06-10T00:00:00
db:	JVNDB	id:	JVNDB-2025-005961	date:	2025-05-29T00:00:00
db:	NVD	id:	CVE-2025-3249	date:	2025-04-04T14:15:25.453