Buffer Overflow Vulnerability in TOTOLINK A702R, A3002R, and A3002RU Devices
CVE-2025-4835

8.7HIGH

Key Information:

Vendor

Totolink
Status
A702r
A3002r
A3002ru
Vendor
CVE Published:
17 May 2025

What is CVE-2025-4835?

A critical vulnerability has been identified in the TOTOLINK A702R, A3002R, and A3002RU devices, specifically within the HTTP POST Request Handler. This issue stems from improper handling of the 'redirect-url' argument within the file /boafrm/formWlanRedirect, leading to a buffer overflow. Remote attackers can exploit this vulnerability to execute arbitrary code, potentially compromising the device's security. It is essential for users to apply necessary patches and updates to safeguard their systems from potential exploits, as the details have been publicly disclosed.

Affected Version(s)

A3002R 3.0.0-B20230809.1615

A3002RU 3.0.0-B20230809.1615

A702R 3.0.0-B20230809.1615

References

https://vuldb.com/?id.309301
vdb-entrytechnical-description
https://vuldb.com/?ctiid.309301
signaturepermissions-required
https://vuldb.com/?submit.574608
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

DaddyShark (VulDB User)
JSON
.