CVE-2025-2688

CWE-266 CWE-284 — Improper Access Control3 documents3 sources

Severity

5.3MEDIUM

EPSS

0.1%

top 82.68%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Totolink A3000ru Firmware Totolink A3000ru

Timeline

PublishedMar 24

Description

A vulnerability classified as problematic was found in TOTOLINK A3000RU up to 5.9c.5185. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ExportSyslog.sh of the component Syslog Configuration File Handler. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶NVDtotolink/a3000ru_firmware5.9c.5185

▶CVEListV5totolink/a3000ru5.9c.5185

🔴Vulnerability Details

GHSA

GHSA-4xp6-5525-gxpx: A vulnerability classified as problematic was found in TOTOLINK A3000RU up to 5↗2025-03-24

▶

CVEList

TOTOLINK A3000RU Syslog Configuration File ExportSyslog.sh access control↗2025-03-24

▶