Totolink A3002R Firmware vulnerabilities

CVE-2025-55591 [CRITICAL] CWE-77 CVE-2025-55591: TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint.

CVE-2025-55588 [HIGH] CWE-400 CVE-2025-55588: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fw_ip param TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fw_ip parameter at /boafrm/formPortFw. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-55587 [HIGH] CWE-400 CVE-2025-55587: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname pa TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-55586 [HIGH] CWE-400 CVE-2025-55586: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the url paramet TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the url parameter at /boafrm/formFilter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-55590 [MEDIUM] CWE-77 CVE-2025-55590: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability v TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability via the component bupload.html.

CVE-2025-55584 [MEDIUM] CWE-1391 CVE-2025-55584: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account.

CVE-2025-55585 [MEDIUM] CWE-95 CVE-2025-55585: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function.

CVE-2025-55589 [MEDIUM] CWE-78 CVE-2025-55589: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain multiple OS command injection vulner TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain multiple OS command injection vulnerabilities via the macstr, bandstr, and clientoff parameters at /boafrm/formMapDelDevice.

CVE-2025-6486 [HIGH] CWE-119 CVE-2025-6486: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to t

CVE-2025-6487 [HIGH] CWE-119 CVE-2025-6487: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been rated as critical. Th A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been rated as critical. This issue affects the function formRoute of the file /boafrm/formRoute. The manipulation of the argument subnet leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-6485 [MEDIUM] CWE-77 CVE-2025-6485: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critica A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critical. This affects the function formWlSiteSurvey of the file /boafrm/formWlSiteSurvey. The manipulation of the argument wlanif leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and ma

CVE-2025-6393 [HIGH] CWE-119 CVE-2025-6393: A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B20230809.1615/4.0.0- A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B20230809.1615/4.0.0-B20230531.1404/4.0.0-B20230721.1521/4.1.2cu.5232_B20210713. It has been classified as critical. Affected is an unknown function of the file /boafrm/formIPv6Addr of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads

CVE-2025-6337 [HIGH] CWE-119 CVE-2025-6337: A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615/4.0.0-B20230531.1404. A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615/4.0.0-B20230531.1404. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formTmultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can b

CVE-2025-6164 [HIGH] CWE-119 CVE-2025-6164: A vulnerability was found in TOTOLINK A3002R 4.0.0-B20230531.1404. It has been classified as critica A vulnerability was found in TOTOLINK A3002R 4.0.0-B20230531.1404. It has been classified as critical. This affects an unknown part of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclose

CVE-2025-6149 [HIGH] CWE-119 CVE-2025-6149: A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20230531.1404. Affec A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20230531.1404. Affected is an unknown function of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the

CVE-2025-45862 [MEDIUM] CWE-121 CVE-2025-45862: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the interfacen TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the interfacenameds parameter in the formDhcpv6s interface.

CVE-2025-4852 [MEDIUM] CWE-79 CVE-2025-4852: A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230 A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the component VPN Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-4831 [HIGH] CWE-119 CVE-2025-4831: A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3 A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formSiteSurveyProfile of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. T

CVE-2025-4829 [HIGH] CWE-119 CVE-2025-4829: A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B202308 A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. Affected by this vulnerability is the function sub_40BE30 of the file /boafrm/formStats of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exp

CVE-2025-4834 [HIGH] CWE-119 CVE-2025-4834: A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been cl A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been classified as critical. Affected is an unknown function of the file /boafrm/formSetLg of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit