CVE-2025-8140
published 2025-07-25CVE-2025-8140: A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been declared as critical. This vulnerability affects unknown code of the file…
PriorityP269high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
7.10%
93.5th percentile
A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formWlanMultipleAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| msrc | azl3_unzip_6.0-20_on_azure_linux_3.0 | — | — |
| msrc | azl3_unzip_6.0-22_on_azure_linux_3.0 | — | — |
| msrc | cbl2_unzip_6.0-19_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_unzip_6.0-16_on_cbl_mariner_1.0 | — | — |
| msrc | unzip-6.0-16.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | unzip-6.0-16.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | unzip-6.0-19.cm2.aarch64.rpm_on_cbl_mariner_2.0_arm | — | — |
| msrc | unzip-6.0-19.cm2.x86_64.rpm_on_cbl_mariner_2.0_x64 | — | — |
| msrc | unzip-6.0-20.azl3.aarch64.rpm_on_azure_linux_3.0_arm | — | — |
| msrc | unzip-6.0-20.azl3.x86_64.rpm_on_azure_linux_3.0_x64 | — | — |
| msrc | unzip-debuginfo-6.0-16.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | unzip-debuginfo-6.0-16.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | unzip-debuginfo-6.0-19.cm2.aarch64.rpm_on_cbl_mariner_2.0_arm | — | — |
| msrc | unzip-debuginfo-6.0-19.cm2.x86_64.rpm_on_cbl_mariner_2.0_x64 | — | — |
| totolink | a702r | — | — |
| totolink | a702r_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink formWlanMultipleAP submit-url Parameter Buffer Overflow Attempt (CVE-2025-8140)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:26; content:"/boafrm/formWlanMultipleAP"; fast_pattern; http.request_body; content:"submit-url|3d|"; pcre:"/^[^\x26$]{100,}(?:\x26|$)/R"; reference:url,github.com/panda666-888/vuls; reference:cve,2025-8140; classtype:web-application-attack; sid:2063720; rev:1; metadata:affected_product TOTOLINK, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_07_25, cve CVE_2025_8140, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_07_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)- →Detect HTTP POST requests to the exact URI /boafrm/formWlanMultipleAP (URI length is exactly 26 bytes) targeting TOTOLINK A702R devices. ↗
- →Flag POST request bodies containing the 'submit-url=' parameter (URL-encoded as 'submit-url=') where the value exceeds 100 characters before an ampersand or end-of-body — indicative of a buffer overflow attempt. ↗
- →The exploit is publicly disclosed; monitor for exploitation attempts originating from external/perimeter networks against internal networking equipment (TOTOLINK routers) over plaintext HTTP. ↗
- →Map detections to MITRE ATT&CK: Initial Access (TA0001) via Exploit Public-Facing Application (T1190). ↗
- ·The vulnerability affects a specific firmware version of TOTOLINK A702R; ensure version scoping is applied when deploying detections to avoid false positives on other TOTOLINK models. ↗
- ·The Snort/Suricata rule (sid:2063720) uses a fixed URI bsize of 26 bytes; any URL rewriting or proxy normalization that alters the URI length may cause the rule to miss the attack. ↗
- ·Detection only applies to plaintext HTTP traffic; if the device is placed behind a TLS-terminating proxy, traffic must be decrypted before inspection. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4g9q-w72v-3543: A vulnerability was found in TOTOLINK A702R 4
ghsa_unreviewed·2025-07-25
CVE-2025-8140 [HIGH] CWE-119 GHSA-4g9q-w72v-3543: A vulnerability was found in TOTOLINK A702R 4
A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formWlanMultipleAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Microsoft
Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the un
vendor_msrc·2020-01-14·CVSS 7.8
CVE-2014-8140 [HIGH] CWE-787 Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the un
Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we wil
Suricata
ET WEB_SPECIFIC_APPS Totolink formWlanMultipleAP submit-url Parameter Buffer Overflow Attempt (CVE-2025-8140)
suricata·2025-07-25·CVSS 7.4
CVE-2025-8140 [HIGH] ET WEB_SPECIFIC_APPS Totolink formWlanMultipleAP submit-url Parameter Buffer Overflow Attempt (CVE-2025-8140)
ET WEB_SPECIFIC_APPS Totolink formWlanMultipleAP submit-url Parameter Buffer Overflow Attempt (CVE-2025-8140)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink formWlanMultipleAP submit-url Parameter Buffer Overflow Attempt (CVE-2025-8140)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:26; content:"/boafrm/formWlanMultipleAP"; fast_pattern; http.request_body; content:"submit-url|3d|"; pcre:"/^[^\x26$]{100,}(?:\x26|$)/R"; reference:url,github.com/panda666-888/vuls; reference:cve,2025-8140; classtype:web-application-attack; sid:2063720; rev:1; metadata:affected_product TOTOLINK, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_07_25, cve CVE_2025_8140, deployment Perimeter, deployment Internal, performance_impac
No public exploits indexed.
No writeups or analysis indexed.
2025-07-25
Published