Details of VAR-202506-0401

ID

VAR-202506-0401

CVE

CVE-2025-5671

TITLE

TOTOLINK of N302R Plus Buffer error vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-007251

DESCRIPTION

A vulnerability, which was classified as critical, was found in TOTOLINK N302R Plus up to 3.4.0-B20201028. Affected is an unknown function of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. TOTOLINK of N302R Plus The firmware contains a buffer error vulnerability and a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK N300R Plus is a wireless router. The vulnerability is caused by incorrect operation of the parameter service_type. Attackers can use this vulnerability to execute arbitrary code

Trust: 2.16

sources: NVD: CVE-2025-5671 // JVNDB: JVNDB-2025-007251 // CNVD: CNVD-2025-12875

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-12875

AFFECTED PRODUCTS

vendor:	totolink	model:	n302r plus	scope:	lt	version:	3.4.0-b20201028	Trust: 1.0
vendor:	totolink	model:	n302r plus	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	n302r plus	scope:	eq	version:	-	Trust: 0.8
vendor:	totolink	model:	n302r plus	scope:	eq	version:	n302r plus firmware 3.4.0-b20201028	Trust: 0.8
vendor:	totolink	model:	n302r plus <=3.4.0-b20201028	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-12875 // JVNDB: JVNDB-2025-007251 // NVD: CVE-2025-5671

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-5671
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2025-007251
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2025-12875
value:	HIGH
Trust: 0.6

cna@vuldb.com:	CVE-2025-5671
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-007251
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2025-12875
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2025-5671
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2025-007251
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-12875 // JVNDB: JVNDB-2025-007251 // NVD: CVE-2025-5671

PROBLEMTYPE DATA

problemtype:	CWE-119	Trust: 1.0
problemtype:	CWE-120	Trust: 1.0
problemtype:	Buffer error (CWE-119) [ others ]	Trust: 0.8
problemtype:	Classic buffer overflow (CWE-120) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-007251 // NVD: CVE-2025-5671

EXTERNAL IDS

db:	NVD	id:	CVE-2025-5671	Trust: 3.2
db:	VULDB	id:	311160	Trust: 1.8
db:	JVNDB	id:	JVNDB-2025-007251	Trust: 0.8
db:	CNVD	id:	CNVD-2025-12875	Trust: 0.6

sources: CNVD: CNVD-2025-12875 // JVNDB: JVNDB-2025-007251 // NVD: CVE-2025-5671

REFERENCES

url:	https://vuldb.com/?id.311160	Trust: 1.8
url:	https://vuldb.com/?submit.590093	Trust: 1.8
url:	https://www.totolink.net/	Trust: 1.8
url:	https://github.com/byxs0x0/cve2/blob/main/530/1.md	Trust: 1.6
url:	https://vuldb.com/?ctiid.311160	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2025-5671	Trust: 0.8

sources: CNVD: CNVD-2025-12875 // JVNDB: JVNDB-2025-007251 // NVD: CVE-2025-5671

SOURCES

db:	CNVD	id:	CNVD-2025-12875
db:	JVNDB	id:	JVNDB-2025-007251
db:	NVD	id:	CVE-2025-5671

LAST UPDATE DATE

2025-06-21T23:21:23.338000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-12875	date:	2025-06-19T00:00:00
db:	JVNDB	id:	JVNDB-2025-007251	date:	2025-06-19T05:36:00
db:	NVD	id:	CVE-2025-5671	date:	2025-06-17T20:38:46.383

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-12875	date:	2025-06-19T00:00:00
db:	JVNDB	id:	JVNDB-2025-007251	date:	2025-06-19T00:00:00
db:	NVD	id:	CVE-2025-5671	date:	2025-06-05T18:15:22.947