Details of VAR-202505-1746

ID

VAR-202505-1746

CVE

CVE-2025-4732

TITLE

TOTOLINK of A3002R firmware and A3002RU Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-007354

DESCRIPTION

A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. TOTOLINK of A3002R firmware and A3002RU The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK A3002R and A3002RU are two high-performance dual-band wireless routers. The vulnerability is related to /boafrm/formFilter and is caused by the failure to properly validate the ip6addr parameter entered by the user. An attacker can exploit this vulnerability to execute arbitrary code

Trust: 2.16

sources: NVD: CVE-2025-4732 // JVNDB: JVNDB-2025-007354 // CNVD: CNVD-2025-11997

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-11997

AFFECTED PRODUCTS

vendor:	totolink	model:	a3002ru	scope:	eq	version:	3.0.0-b20230809.1615	Trust: 1.0
vendor:	totolink	model:	a3002r	scope:	eq	version:	3.0.0-b20230809.1615	Trust: 1.0
vendor:	totolink	model:	a3002ru	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a3002r	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a3002r 3.0.0-b20230809.1615	scope:	-	version:	-	Trust: 0.6
vendor:	totolink	model:	a3002ru 3.0.0-b20230809.1615	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-11997 // JVNDB: JVNDB-2025-007354 // NVD: CVE-2025-4732

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-4732
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2025-007354
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2025-11997
value:	HIGH
Trust: 0.6

cna@vuldb.com:	CVE-2025-4732
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-007354
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2025-11997
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2025-4732
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2025-007354
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-11997 // JVNDB: JVNDB-2025-007354 // NVD: CVE-2025-4732

PROBLEMTYPE DATA

problemtype:	CWE-120	Trust: 1.0
problemtype:	CWE-119	Trust: 1.0
problemtype:	Buffer error (CWE-119) [ others ]	Trust: 0.8
problemtype:	Classic buffer overflow (CWE-120) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-007354 // NVD: CVE-2025-4732

EXTERNAL IDS

db:	NVD	id:	CVE-2025-4732	Trust: 3.2
db:	VULDB	id:	309034	Trust: 1.8
db:	JVNDB	id:	JVNDB-2025-007354	Trust: 0.8
db:	CNVD	id:	CNVD-2025-11997	Trust: 0.6

sources: CNVD: CNVD-2025-11997 // JVNDB: JVNDB-2025-007354 // NVD: CVE-2025-4732

REFERENCES

url:	https://vuldb.com/?id.309034	Trust: 1.8
url:	https://vuldb.com/?submit.570690	Trust: 1.8
url:	https://www.totolink.net/	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2025-4732	Trust: 1.4
url:	https://vuldb.com/?ctiid.309034	Trust: 1.0
url:	https://github.com/ch13hh/tmp_store_cc/blob/main/tt/ta/6.md	Trust: 1.0

sources: CNVD: CNVD-2025-11997 // JVNDB: JVNDB-2025-007354 // NVD: CVE-2025-4732

SOURCES

db:	CNVD	id:	CNVD-2025-11997
db:	JVNDB	id:	JVNDB-2025-007354
db:	NVD	id:	CVE-2025-4732

LAST UPDATE DATE

2025-06-24T23:16:47.239000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-11997	date:	2025-06-10T00:00:00
db:	JVNDB	id:	JVNDB-2025-007354	date:	2025-06-23T04:51:00
db:	NVD	id:	CVE-2025-4732	date:	2025-06-20T14:09:31.560

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-11997	date:	2025-06-10T00:00:00
db:	JVNDB	id:	JVNDB-2025-007354	date:	2025-06-23T00:00:00
db:	NVD	id:	CVE-2025-4732	date:	2025-05-16T01:15:51.980