CVE-2025-4732

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
TOTOLINK	A3002R	3.0.0-B20230809.1615
TOTOLINK	A3002RU	3.0.0-B20230809.1615

References

https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/6.mdBroken Link
https://vuldb.com/?ctiid.309034Permissions Required, VDB Entry
https://vuldb.com/?id.309034Third Party Advisory, VDB Entry
https://vuldb.com/?submit.570690Third Party Advisory, VDB Entry
https://www.totolink.net/Product

Timeline

Published: May 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-473207.8Memory corruption while processing MFC channel configuration during music playback.CVE-2025-473217.8Memory corruption while copying packets received from unix clients.CVE-2025-473227.8Memory corruption while handling IOCTL calls to set mode.CVE-2025-473237.8Memory corruption while routing GPR packets between user and root when handling large data packet.CVE-2025-473247.5Information disclosure while accessing and modifying the PIB file of a remote device via powerline.CVE-2025-473255.5Information disclosure while processing system calls with invalid parameters.CVE-2025-473267.5Transient DOS while handling command data during power control processing.CVE-2025-473277.8Memory corruption while encoding the image data.CVE-2025-473287.5Transient DOS while processing power control requests with invalid antenna or stream values.CVE-2025-473297.8Memory corruption while handling invalid inputs in application info setup.CVE-2025-47338.8A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects so CVE-2025-473305.5Transient DOS while parsing video packets received from the video firmware.