Details of VAR-202505-1677

ID

VAR-202505-1677

CVE

CVE-2025-4733

TITLE

TOTOLINK of A3002R firmware and A3002RU Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-007383

DESCRIPTION

A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects some unknown processing of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. TOTOLINK of A3002R firmware and A3002RU The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK A3002R and A3002RU are routers produced by TOTOLINK, supporting multiple network functions and services. No detailed vulnerability details are currently available

Trust: 2.16

sources: NVD: CVE-2025-4733 // JVNDB: JVNDB-2025-007383 // CNVD: CNVD-2025-11996

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-11996

AFFECTED PRODUCTS

vendor:	totolink	model:	a3002ru	scope:	eq	version:	3.0.0-b20230809.1615	Trust: 1.0
vendor:	totolink	model:	a3002r	scope:	eq	version:	3.0.0-b20230809.1615	Trust: 1.0
vendor:	totolink	model:	a3002r	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a3002ru	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a3002r 3.0.0-b20230809.1615	scope:	-	version:	-	Trust: 0.6
vendor:	totolink	model:	a3002ru 3.0.0-b20230809.1615	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-11996 // JVNDB: JVNDB-2025-007383 // NVD: CVE-2025-4733

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-4733
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2025-007383
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2025-11996
value:	HIGH
Trust: 0.6

cna@vuldb.com:	CVE-2025-4733
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-007383
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2025-11996
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2025-4733
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2025-007383
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-11996 // JVNDB: JVNDB-2025-007383 // NVD: CVE-2025-4733

PROBLEMTYPE DATA

problemtype:	CWE-120	Trust: 1.0
problemtype:	CWE-119	Trust: 1.0
problemtype:	Buffer error (CWE-119) [ others ]	Trust: 0.8
problemtype:	Classic buffer overflow (CWE-120) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-007383 // NVD: CVE-2025-4733

EXTERNAL IDS

db:	NVD	id:	CVE-2025-4733	Trust: 3.2
db:	VULDB	id:	309035	Trust: 2.4
db:	JVNDB	id:	JVNDB-2025-007383	Trust: 0.8
db:	CNVD	id:	CNVD-2025-11996	Trust: 0.6

sources: CNVD: CNVD-2025-11996 // JVNDB: JVNDB-2025-007383 // NVD: CVE-2025-4733

REFERENCES

url:	https://vuldb.com/?id.309035	Trust: 2.4
url:	https://vuldb.com/?submit.570703	Trust: 2.4
url:	https://www.totolink.net/	Trust: 2.4
url:	https://github.com/ch13hh/tmp_store_cc/blob/main/tt/ta/7.md	Trust: 1.6
url:	https://vuldb.com/?ctiid.309035	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2025-4733	Trust: 0.8

sources: CNVD: CNVD-2025-11996 // JVNDB: JVNDB-2025-007383 // NVD: CVE-2025-4733

SOURCES

db:	CNVD	id:	CNVD-2025-11996
db:	JVNDB	id:	JVNDB-2025-007383
db:	NVD	id:	CVE-2025-4733

LAST UPDATE DATE

2025-06-29T23:14:08.809000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-11996	date:	2025-06-10T00:00:00
db:	JVNDB	id:	JVNDB-2025-007383	date:	2025-06-23T13:59:00
db:	NVD	id:	CVE-2025-4733	date:	2025-06-20T14:09:01.650

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-11996	date:	2025-06-10T00:00:00
db:	JVNDB	id:	JVNDB-2025-007383	date:	2025-06-23T00:00:00
db:	NVD	id:	CVE-2025-4733	date:	2025-05-16T01:15:52.147