Buffer Overflow Vulnerability in TOTOLINK N302R Plus due to HTTP POST Request Manipulation
CVE-2025-5671

8.7HIGH

Key Information:

Vendor

Totolink
Status
N302r Plus
Vendor
CVE Published:
5 June 2025

What is CVE-2025-5671?

A buffer overflow vulnerability exists in the TOTOLINK N302R Plus, specifically within the /boafrm/formPortFw component that processes HTTP POST requests. The flaw arises from improper handling of the 'service_type' argument, allowing an attacker to exploit this weakness remotely. Successful exploitation could lead to unauthorized access or control over the device, posing significant security risks to affected users. It is crucial to apply necessary updates and monitor for signs of exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

N302R Plus 3.4.0-B20201028

References

https://vuldb.com/?id.311160
vdb-entrytechnical-description
https://vuldb.com/?ctiid.311160
signaturepermissions-required
https://vuldb.com/?submit.590093
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wanglun_ (VulDB User)
JSON
.