CVE-2025-6485

CWE-77 — Command InjectionCWE-78 — OS Command Injection4 documents4 sources
Severity
5.3MEDIUM
EPSS
3.0%
top 13.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink A3002rTotolink A3002r Firmware
Timeline
PublishedJun 22

Description

A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critical. This affects the function formWlSiteSurvey of the file /boafrm/formWlSiteSurvey. The manipulation of the argument wlanif leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/a3002r1.1.1-B20200824.0128
▶NVDtotolink/a3002r_firmware1.1.1-b20200824.0128

🔴Vulnerability Details

3
CVEList
TOTOLINK A3002R formWlSiteSurvey os command injection↗2025-06-22
▶
GHSA
GHSA-mwpg-84jx-gc55: A vulnerability was found in TOTOLINK A3002R 1↗2025-06-22
▶
VulnCheck
totolink a3002r_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')↗2025
▶
CVE-2025-6485 (MEDIUM CVSS 5.3) | A vulnerability was found in TOTOLI | cvebase.io