CVE-2025-4732
Last modified
CVE-2025-4732 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. EPSS estimates a 0.66% chance of exploitation in the next 30 days.
Description
A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Totolink | A3002r Firmware | 3.0.0-b20230809.1615 |
| Totolink | A3002ru Firmware | 3.0.0-b20230809.1615 |
References
- https://vuldb.com/?ctiid.309034Permissions Required, VDB Entry
- https://vuldb.com/?id.309034Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.570690Third Party Advisory, VDB Entry
- https://www.totolink.net/Product
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-4732?
How severe is CVE-2025-4732?
How do I fix CVE-2025-4732?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-47314Memory corruption while processing data sent by FE driver.7.8
- CVE-2025-47315Memory corruption while handling repeated memory unmap reque…7.8
- CVE-2025-47316Memory corruption due to double free when multiple threads r…7.8
- CVE-2025-47317Memory corruption due to global buffer overflow when a test …7.8
- CVE-2025-47318Transient DOS while parsing the EPTM test control message to…7.5
- CVE-2025-47319Information disclosure while exposing internal TA-to-TA comm…6.7
- CVE-2025-47320Memory corruption while processing MFC channel configuration…7.8
- CVE-2025-47321Memory corruption while copying packets received from unix c…7.8
- CVE-2025-47322Memory corruption while handling IOCTL calls to set mode.7.8
- CVE-2025-47323Memory corruption while routing GPR packets between user and…7.8
- CVE-2025-47324Information disclosure while accessing and modifying the PIB…7.5
- CVE-2025-47325Information disclosure while processing system calls with in…5.5
Are you affected by CVE-2025-4732?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST