Sign-up

ID

VAR-202505-1630


CVE

CVE-2025-4729


TITLE

TOTOLINK A3002R and A3002RU Command Injection Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-11977

DESCRIPTION

A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. TOTOLINK A3002R and A3002RU are routers produced by TOTOLINK, supporting multiple network functions and services. No detailed vulnerability details are currently provided

Trust: 1.44

sources: NVD: CVE-2025-4729 // CNVD: CNVD-2025-11977

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-11977

AFFECTED PRODUCTS

vendor:totolinkmodel:a3002r 3.0.0-b20230809.1615scope: - version: -

Trust: 0.6

vendor:totolinkmodel:a3002ru 3.0.0-b20230809.1615scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-11977

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-4729
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2025-11977
value: MEDIUM

Trust: 0.6

cna@vuldb.com: CVE-2025-4729
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

CNVD: CNVD-2025-11977
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-4729
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.4
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2025-11977 // NVD: CVE-2025-4729

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.0

problemtype:CWE-74

Trust: 1.0

sources: NVD: CVE-2025-4729

EXTERNAL IDS

db:NVDid:CVE-2025-4729

Trust: 1.6

db:VULDBid:309031

Trust: 1.6

db:CNVDid:CNVD-2025-11977

Trust: 0.6

sources: CNVD: CNVD-2025-11977 // NVD: CVE-2025-4729

REFERENCES

url:https://github.com/ch13hh/tmp_store_cc/blob/main/tt/ta/2.md

Trust: 1.6

url:https://vuldb.com/?ctiid.309031

Trust: 1.6

url:https://vuldb.com/?id.309031

Trust: 1.6

url:https://vuldb.com/?submit.570686

Trust: 1.6

url:https://www.totolink.net/

Trust: 1.6

sources: CNVD: CNVD-2025-11977 // NVD: CVE-2025-4729

SOURCES

db:CNVDid:CNVD-2025-11977
db:NVDid:CVE-2025-4729

LAST UPDATE DATE

2025-06-12T02:07:06.553000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-11977date:2025-06-10T00:00:00
db:NVDid:CVE-2025-4729date:2025-05-16T14:42:18.700

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-11977date:2025-06-10T00:00:00
db:NVDid:CVE-2025-4729date:2025-05-16T00:15:19.793