Sign-up

ID

VAR-202505-1746


CVE

CVE-2025-4732


TITLE

TOTOLINK A3002R and A3002RU Buffer Overflow Vulnerability (CNVD-2025-11997)

Trust: 0.6

sources: CNVD: CNVD-2025-11997

DESCRIPTION

A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. TOTOLINK A3002R and A3002RU are two high-performance dual-band wireless routers. The vulnerability is related to /boafrm/formFilter and is caused by the failure to properly validate the ip6addr parameter entered by the user. An attacker can exploit this vulnerability to execute arbitrary code

Trust: 1.44

sources: NVD: CVE-2025-4732 // CNVD: CNVD-2025-11997

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-11997

AFFECTED PRODUCTS

vendor:totolinkmodel:a3002r 3.0.0-b20230809.1615scope: - version: -

Trust: 0.6

vendor:totolinkmodel:a3002ru 3.0.0-b20230809.1615scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-11997

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-4732
value: HIGH

Trust: 1.0

CNVD: CNVD-2025-11997
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2025-4732
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

CNVD: CNVD-2025-11997
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-4732
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2025-11997 // NVD: CVE-2025-4732

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:CWE-120

Trust: 1.0

sources: NVD: CVE-2025-4732

EXTERNAL IDS

db:NVDid:CVE-2025-4732

Trust: 1.6

db:VULDBid:309034

Trust: 1.0

db:CNVDid:CNVD-2025-11997

Trust: 0.6

sources: CNVD: CNVD-2025-11997 // NVD: CVE-2025-4732

REFERENCES

url:https://www.totolink.net/

Trust: 1.0

url:https://vuldb.com/?id.309034

Trust: 1.0

url:https://github.com/ch13hh/tmp_store_cc/blob/main/tt/ta/6.md

Trust: 1.0

url:https://vuldb.com/?ctiid.309034

Trust: 1.0

url:https://vuldb.com/?submit.570690

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2025-4732

Trust: 0.6

sources: CNVD: CNVD-2025-11997 // NVD: CVE-2025-4732

SOURCES

db:CNVDid:CNVD-2025-11997
db:NVDid:CVE-2025-4732

LAST UPDATE DATE

2025-06-12T02:27:33.024000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-11997date:2025-06-10T00:00:00
db:NVDid:CVE-2025-4732date:2025-05-16T14:42:18.700

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-11997date:2025-06-10T00:00:00
db:NVDid:CVE-2025-4732date:2025-05-16T01:15:51.980