Buffer Overflow Vulnerability in TOTOLINK A702R HTTP POST Request Handler
CVE-2025-6940
Key Information:
Badges
What is CVE-2025-6940?
A buffer overflow vulnerability has been identified in the TOTOLINK A702R when handling HTTP POST requests through the /boafrm/formParentControl component. The vulnerability arises from improper processing of the 'submit-url' parameter, which can be exploited remotely. Attackers may manipulate this parameter to cause a buffer overflow, potentially compromising the device's functionality and allowing unauthorized access or control. Given the public disclosure of this exploit, it is crucial for users to implement appropriate security measures and updates to safeguard their systems.
Affected Version(s)
A702R 4.0.0-B20230721.1521
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved