Log in Start free

Vulnerability · Published Jun 21, 2025 · Assigned by VulDB

CVE-2025-6393TOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST Request formIPv6Addr buffer overflow

High 8.8

In plain English

A high-severity buffer overflow in A3002R from TOTOLINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 35.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B20230809.1615/4.0.0-B20230531.1404/4.0.0-B20230721.1521/4.1.2cu.5232_B20210713. It has been classified as critical. Affected is an unknown function of the file /boafrm/formIPv6Addr of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

VendorProductVersions
TOTOLINK A702R 3.0.0-B20230809.16154.0.0-B20230531.14044.0.0-B20230721.15214.1.2cu.5232_B20210713
TOTOLINK A3002R 3.0.0-B20230809.16154.0.0-B20230531.14044.0.0-B20230721.15214.1.2cu.5232_B20210713
TOTOLINK A3002RU 3.0.0-B20230809.16154.0.0-B20230531.14044.0.0-B20230721.15214.1.2cu.5232_B20210713
TOTOLINK EX1200T 3.0.0-B20230809.16154.0.0-B20230531.14044.0.0-B20230721.15214.1.2cu.5232_B20210713

Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References