Sign-up

ID

VAR-202506-0048


CVE

CVE-2025-5507


TITLE

TOTOLINK  of  A3002RU  Cross-site scripting vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-007198

DESCRIPTION

A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component MAC Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. TOTOLINK of A3002RU The firmware contains cross-site scripting and code injection vulnerabilities.Information may be obtained and information may be tampered with. TOTOLINK A3002RU is a wireless router product of China's TOTOLINK Electronics. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2025-5507 // JVNDB: JVNDB-2025-007198 // CNVD: CNVD-2025-12123

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-12123

AFFECTED PRODUCTS

vendor:totolinkmodel:a3002ruscope:eqversion:2.1.1-b20230720.1011

Trust: 1.0

vendor:totolinkmodel:a3002ruscope:eqversion: -

Trust: 0.8

vendor:totolinkmodel:a3002ruscope: - version: -

Trust: 0.8

vendor:totolinkmodel:a3002ruscope:eqversion:a3002ru firmware 2.1.1-b20230720.1011

Trust: 0.8

vendor:totolinkmodel:a3002ru 2.1.1-b20230720.1011scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-12123 // JVNDB: JVNDB-2025-007198 // NVD: CVE-2025-5507

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-5507
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2025-5507
value: MEDIUM

Trust: 1.0

OTHER: JVNDB-2025-007198
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2025-12123
value: LOW

Trust: 0.6

cna@vuldb.com: CVE-2025-5507
severity: LOW
baseScore: 3.3
vectorString: AV:N/AC:L/AU:M/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-007198
severity: LOW
baseScore: 3.3
vectorString: AV:N/AC:L/AU:M/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-12123
severity: LOW
baseScore: 3.3
vectorString: AV:N/AC:L/AU:M/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-5507
baseSeverity: LOW
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 0.9
impactScore: 1.4
version: 3.1

Trust: 1.0

nvd@nist.gov: CVE-2025-5507
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.1

Trust: 1.0

NVD: JVNDB-2025-007198
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-12123 // JVNDB: JVNDB-2025-007198 // NVD: CVE-2025-5507 // NVD: CVE-2025-5507

PROBLEMTYPE DATA

problemtype:CWE-94

Trust: 1.0

problemtype:CWE-79

Trust: 1.0

problemtype:Cross-site scripting (CWE-79) [ others ]

Trust: 0.8

problemtype: Code injection (CWE-94) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-007198 // NVD: CVE-2025-5507

EXTERNAL IDS

db:NVDid:CVE-2025-5507

Trust: 3.2

db:VULDBid:310921

Trust: 1.8

db:JVNDBid:JVNDB-2025-007198

Trust: 0.8

db:CNVDid:CNVD-2025-12123

Trust: 0.6

sources: CNVD: CNVD-2025-12123 // JVNDB: JVNDB-2025-007198 // NVD: CVE-2025-5507

REFERENCES

url:https://github.com/fizz-is-on-the-way/iot_vuls/tree/main/a3002ru_v2/xss_mac_filtering

Trust: 2.4

url:https://vuldb.com/?id.310921

Trust: 1.8

url:https://vuldb.com/?submit.584664

Trust: 1.8

url:https://www.totolink.net/

Trust: 1.8

url:https://vuldb.com/?ctiid.310921

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2025-5507

Trust: 0.8

sources: CNVD: CNVD-2025-12123 // JVNDB: JVNDB-2025-007198 // NVD: CVE-2025-5507

SOURCES

db:CNVDid:CNVD-2025-12123
db:JVNDBid:JVNDB-2025-007198
db:NVDid:CVE-2025-5507

LAST UPDATE DATE

2025-06-20T23:18:58.003000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-12123date:2025-06-11T00:00:00
db:JVNDBid:JVNDB-2025-007198date:2025-06-18T02:13:00
db:NVDid:CVE-2025-5507date:2025-06-17T20:40:46.887

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-12123date:2025-06-11T00:00:00
db:JVNDBid:JVNDB-2025-007198date:2025-06-18T00:00:00
db:NVDid:CVE-2025-5507date:2025-06-03T16:15:26.423