Details of VAR-202505-1630

ID

VAR-202505-1630

CVE

CVE-2025-4729

TITLE

TOTOLINK of A3002R firmware and A3002RU Injection Vulnerability in Firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-007372

DESCRIPTION

A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. TOTOLINK of A3002R firmware and A3002RU The firmware contains injection and command injection vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK A3002R and A3002RU are routers produced by TOTOLINK, supporting multiple network functions and services. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2025-4729 // JVNDB: JVNDB-2025-007372 // CNVD: CNVD-2025-11977

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-11977

AFFECTED PRODUCTS

vendor:	totolink	model:	a3002ru	scope:	eq	version:	3.0.0-b20230809.1615	Trust: 1.0
vendor:	totolink	model:	a3002r	scope:	eq	version:	3.0.0-b20230809.1615	Trust: 1.0
vendor:	totolink	model:	a3002ru	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a3002r	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a3002r 3.0.0-b20230809.1615	scope:	-	version:	-	Trust: 0.6
vendor:	totolink	model:	a3002ru 3.0.0-b20230809.1615	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-11977 // JVNDB: JVNDB-2025-007372 // NVD: CVE-2025-4729

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-4729
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2025-007372
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2025-11977
value:	MEDIUM
Trust: 0.6

cna@vuldb.com:	CVE-2025-4729
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-007372
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2025-11977
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2025-4729
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2025-007372
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-11977 // JVNDB: JVNDB-2025-007372 // NVD: CVE-2025-4729

PROBLEMTYPE DATA

problemtype:	CWE-74	Trust: 1.0
problemtype:	CWE-77	Trust: 1.0
problemtype:	injection (CWE-74) [ others ]	Trust: 0.8
problemtype:	Command injection (CWE-77) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-007372 // NVD: CVE-2025-4729

EXTERNAL IDS

db:	NVD	id:	CVE-2025-4729	Trust: 3.2
db:	VULDB	id:	309031	Trust: 2.4
db:	JVNDB	id:	JVNDB-2025-007372	Trust: 0.8
db:	CNVD	id:	CNVD-2025-11977	Trust: 0.6

sources: CNVD: CNVD-2025-11977 // JVNDB: JVNDB-2025-007372 // NVD: CVE-2025-4729

REFERENCES

url:	https://vuldb.com/?id.309031	Trust: 2.4
url:	https://vuldb.com/?submit.570686	Trust: 2.4
url:	https://www.totolink.net/	Trust: 2.4
url:	https://github.com/ch13hh/tmp_store_cc/blob/main/tt/ta/2.md	Trust: 1.6
url:	https://vuldb.com/?ctiid.309031	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2025-4729	Trust: 0.8

sources: CNVD: CNVD-2025-11977 // JVNDB: JVNDB-2025-007372 // NVD: CVE-2025-4729

SOURCES

db:	CNVD	id:	CNVD-2025-11977
db:	JVNDB	id:	JVNDB-2025-007372
db:	NVD	id:	CVE-2025-4729

LAST UPDATE DATE

2025-06-24T23:21:33.016000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-11977	date:	2025-06-10T00:00:00
db:	JVNDB	id:	JVNDB-2025-007372	date:	2025-06-23T06:05:00
db:	NVD	id:	CVE-2025-4729	date:	2025-06-20T14:10:00.287

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-11977	date:	2025-06-10T00:00:00
db:	JVNDB	id:	JVNDB-2025-007372	date:	2025-06-23T00:00:00
db:	NVD	id:	CVE-2025-4729	date:	2025-05-16T00:15:19.793