Vulnerability · Published Jun 22, 2025 · Assigned by VulDB

CVE-2025-6486TOTOLINK A3002R formWlanMultipleAP stack-based overflow

High 8.8

In plain English

A high-severity stack buffer overflow in A3002R from TOTOLINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.0%top 36.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
TOTOLINK	A3002R	1.1.1-B20200824.0128

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-313594 | TOTOLINK A3002R formWlanMultipleAP stack-based overflow vdb-entry, technical-description
VDB-313594 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #600728 | TOTOLINK A3002R V1.1.1-B20200824.0128 stack third-party-advisory
https://github.com/wudipjq/my_vuln/blob/main/totolink3/vuln_35/35.md exploit
https://www.totolink.net/ product