CVE-2025-8139
published 2025-07-25CVE-2025-8139: A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been classified as critical. This affects an unknown part of the file…
PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.98%
58.1th percentile
A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been classified as critical. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| msrc | azl3_unzip_6.0-20_on_azure_linux_3.0 | — | — |
| msrc | azl3_unzip_6.0-22_on_azure_linux_3.0 | — | — |
| msrc | cbl2_unzip_6.0-19_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_unzip_6.0-16_on_cbl_mariner_1.0 | — | — |
| msrc | unzip-6.0-16.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | unzip-6.0-16.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | unzip-6.0-19.cm2.aarch64.rpm_on_cbl_mariner_2.0_arm | — | — |
| msrc | unzip-6.0-19.cm2.x86_64.rpm_on_cbl_mariner_2.0_x64 | — | — |
| msrc | unzip-6.0-20.azl3.aarch64.rpm_on_azure_linux_3.0_arm | — | — |
| msrc | unzip-6.0-20.azl3.x86_64.rpm_on_azure_linux_3.0_x64 | — | — |
| msrc | unzip-debuginfo-6.0-16.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | unzip-debuginfo-6.0-16.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | unzip-debuginfo-6.0-19.cm2.aarch64.rpm_on_cbl_mariner_2.0_arm | — | — |
| msrc | unzip-debuginfo-6.0-19.cm2.x86_64.rpm_on_cbl_mariner_2.0_x64 | — | — |
| totolink | a702r | — | — |
| totolink | a702r_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT
urlhttps://github.com/panda666-888/vuls
snort
alert http1 any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink formPortFw service_type Parameter Buffer Overflow Attempt (CVE-2025-3988, CVE-2025-8139)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:18; content:"/boafrm/formPortFw"; fast_pattern; http.request_body; content:"service_type"; pcre:"/^\x3d[^\x26$]{100,}(?:&|$)/R"; http.header_names; content:!"\x0d\x0aCookie\x0d\x0a"; reference:cve,2025-3988; reference:url,github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT; reference:cve,2025-5793; reference:cve,2025-8139; reference:url,github.com/panda666-888/vuls; classtype:web-application-attack; sid:2062171; rev:2;)- →Match HTTP POST requests to the exact URI /boafrm/formPortFw (bsize:18) containing a 'service_type' parameter value of 100 or more characters in the request body — indicative of a buffer overflow attempt.
- →Absence of a Cookie header in the HTTP request is a characteristic of this exploit traffic and can be used as an additional filter to reduce false positives.
- →Traffic is plaintext (non-TLS), targeting networking equipment at the perimeter or internally; classify as web-application-attack / Exploit_Public_Facing_Application (MITRE T1190, TA0001).
- ·The affected version is TOTOLINK A702R 4.0.0-B20230721.1521; scope detection to traffic destined for devices running this firmware to minimise noise.
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-862h-mghm-42j7: A vulnerability was found in TOTOLINK A702R 4
ghsa_unreviewed·2025-07-25
CVE-2025-8139 [HIGH] CWE-119 GHSA-862h-mghm-42j7: A vulnerability was found in TOTOLINK A702R 4
A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been classified as critical. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Microsoft
Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip
vendor_msrc·2020-01-14·CVSS 7.8
CVE-2014-8139 [HIGH] CWE-787 Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip
Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will up
Suricata
ET WEB_SPECIFIC_APPS Totolink formPortFw service_type Parameter Buffer Overflow Attempt (CVE-2025-3988, CVE-2025-8139)
suricata·2025-05-08·CVSS 8.7
CVE-2025-3988 [HIGH] ET WEB_SPECIFIC_APPS Totolink formPortFw service_type Parameter Buffer Overflow Attempt (CVE-2025-3988, CVE-2025-8139)
ET WEB_SPECIFIC_APPS Totolink formPortFw service_type Parameter Buffer Overflow Attempt (CVE-2025-3988, CVE-2025-8139)
Rule: alert http1 any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink formPortFw service_type Parameter Buffer Overflow Attempt (CVE-2025-3988, CVE-2025-8139)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:18; content:"/boafrm/formPortFw"; fast_pattern; http.request_body; content:"service_type"; pcre:"/^\x3d[^\x26$]{100,}(?:&|$)/R"; http.header_names; content:!"|0d 0a|Cookie|0d 0a|"; reference:cve,2025-3988; reference:url,github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT; reference:cve,2025-5793; reference:cve,2025-8139; reference:url,github.com/panda666-888/vuls; classtype:web-application-attack; sid:2062171; rev:2; metadata:aff
No public exploits indexed.
No writeups or analysis indexed.
2025-07-25
Published