CVE-2025-5506

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been classified as problematic. Affected is an unknown function of the component NAT Mapping Page. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jun 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-550606.1CWE-601 URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-550618.8CWE-434 Unrestricted Upload of File with Dangerous Type CVE-2025-550624.8CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2025-550634.8CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2025-550644.8CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2025-550657.5CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-550677.1The TLS4B ATG system is vulnerable to improper handling of Unix time values that exceed the 2038 epoch rollover. When the system clock reach CVE-2025-550688.2Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacker can manually chang CVE-2025-550698.3A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The v CVE-2025-55075.4A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been declared as problematic. Affected by this vulnerability is a CVE-2025-550707.5Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access se CVE-2025-550716.1A reflected cross-site scripting (xss) vulnerability exists in the modifyAnonymize functionality of MedDream PACS Premium 7.3.6.870. A speci