Sign-up

ID

VAR-202505-1655


CVE

CVE-2025-4731


TITLE

TOTOLINK A3002R and A3002RU Buffer Overflow Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-11978

DESCRIPTION

A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type/ip_subnet leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. TOTOLINK A3002R and A3002RU are routers produced by TOTOLINK, supporting multiple network functions and services. No detailed vulnerability details are currently provided

Trust: 1.44

sources: NVD: CVE-2025-4731 // CNVD: CNVD-2025-11978

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-11978

AFFECTED PRODUCTS

vendor:totolinkmodel:a3002r 3.0.0-b20230809.1615scope: - version: -

Trust: 0.6

vendor:totolinkmodel:a3002ru 3.0.0-b20230809.1615scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-11978

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-4731
value: HIGH

Trust: 1.0

CNVD: CNVD-2025-11978
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2025-4731
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

CNVD: CNVD-2025-11978
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-4731
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2025-11978 // NVD: CVE-2025-4731

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:CWE-120

Trust: 1.0

sources: NVD: CVE-2025-4731

EXTERNAL IDS

db:NVDid:CVE-2025-4731

Trust: 1.6

db:VULDBid:309033

Trust: 1.6

db:CNVDid:CNVD-2025-11978

Trust: 0.6

sources: CNVD: CNVD-2025-11978 // NVD: CVE-2025-4731

REFERENCES

url:https://github.com/ch13hh/tmp_store_cc/blob/main/tt/ta/4.md

Trust: 1.6

url:https://vuldb.com/?ctiid.309033

Trust: 1.6

url:https://vuldb.com/?id.309033

Trust: 1.6

url:https://vuldb.com/?submit.570688

Trust: 1.6

url:https://www.totolink.net/

Trust: 1.6

sources: CNVD: CNVD-2025-11978 // NVD: CVE-2025-4731

SOURCES

db:CNVDid:CNVD-2025-11978
db:NVDid:CVE-2025-4731

LAST UPDATE DATE

2025-06-12T02:10:56.379000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-11978date:2025-06-10T00:00:00
db:NVDid:CVE-2025-4731date:2025-05-16T16:15:46.290

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-11978date:2025-06-10T00:00:00
db:NVDid:CVE-2025-4731date:2025-05-16T00:15:20.147