Details of VAR-202505-0747

ID

VAR-202505-0747

CVE

CVE-2025-45789

TITLE

TOTOLINK of A3100R Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-005194

DESCRIPTION

TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules. TOTOLINK of A3100R An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK A3100R is a series of wireless routers from China's TOTOLINK Electronics. The vulnerability is caused by the failure of the urlKeyword parameter in setParentalRules to properly verify the length of the input data. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2025-45789 // JVNDB: JVNDB-2025-005194 // CNVD: CNVD-2025-11203

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-11203

AFFECTED PRODUCTS

vendor:	totolink	model:	a3100r	scope:	eq	version:	5.9c.1527	Trust: 1.0
vendor:	totolink	model:	a3100r	scope:	eq	version:	a3100r firmware 5.9c.1527	Trust: 0.8
vendor:	totolink	model:	a3100r	scope:	eq	version:	-	Trust: 0.8
vendor:	totolink	model:	a3100r	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a3100r v5.9c.1527	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-11203 // JVNDB: JVNDB-2025-005194 // NVD: CVE-2025-45789

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2025-45789
value:	CRITICAL
Trust: 1.0
134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2025-45789
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2025-45789
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2025-11203
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2025-11203
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2025-45789
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2025-45789
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.5
version:	3.1
Trust: 1.0
NVD:	CVE-2025-45789
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-11203 // JVNDB: JVNDB-2025-005194 // NVD: CVE-2025-45789 // NVD: CVE-2025-45789

PROBLEMTYPE DATA

problemtype:	CWE-121	Trust: 1.0
problemtype:	CWE-787	Trust: 1.0
problemtype:	Stack-based buffer overflow (CWE-121) [ others ]	Trust: 0.8
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-005194 // NVD: CVE-2025-45789

PATCH

title:

Patch for TOTOLINK A3100R setParentalRules function buffer overflow vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/692936

Trust: 0.6

sources: CNVD: CNVD-2025-11203

EXTERNAL IDS

db:	NVD	id:	CVE-2025-45789	Trust: 3.2
db:	JVNDB	id:	JVNDB-2025-005194	Trust: 0.8
db:	CNVD	id:	CNVD-2025-11203	Trust: 0.6

sources: CNVD: CNVD-2025-11203 // JVNDB: JVNDB-2025-005194 // NVD: CVE-2025-45789

REFERENCES

url:	https://github.com/sunnyyangyaya/cuicuishark-sheep-fishiot/blob/main/totolink/a3100r-3/readme.md	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2025-45789	Trust: 0.8

sources: CNVD: CNVD-2025-11203 // JVNDB: JVNDB-2025-005194 // NVD: CVE-2025-45789

SOURCES

db:	CNVD	id:	CNVD-2025-11203
db:	JVNDB	id:	JVNDB-2025-005194
db:	NVD	id:	CVE-2025-45789

LAST UPDATE DATE

2025-05-31T23:03:12.065000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-11203	date:	2025-05-30T00:00:00
db:	JVNDB	id:	JVNDB-2025-005194	date:	2025-05-19T05:20:00
db:	NVD	id:	CVE-2025-45789	date:	2025-05-16T15:38:07.317

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-11203	date:	2025-05-30T00:00:00
db:	JVNDB	id:	JVNDB-2025-005194	date:	2025-05-19T00:00:00
db:	NVD	id:	CVE-2025-45789	date:	2025-05-08T20:15:30.207