cnvd - cnvd-2025-11977

cnvd-2025-11977

Vulnerability from cnvd

Title: TOTOLINK A3002R和A3002RU命令注入漏洞

Description:

TOTOLINK A3002R和A3002RU是TOTOLINK公司生产的路由器，支持多种网络功能和服务。

TOTOLINK A3002R和A3002RU存在命令注入漏洞，该漏洞源于HTTP POST请求处理程序的/boafrm/formMapDelDevice文件的错误操作。目前没有详细的漏洞细节提供。

Severity: 中

Formal description:

目前厂商尚未发布升级程序修复该安全问题，详情见厂商官网： https://m.totolink.net/

Reference: https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/2.md https://vuldb.com/?ctiid.309031 https://vuldb.com/?id.309031 https://vuldb.com/?submit.570686 https://www.totolink.net/

Impacted products

Name
['TOTOLINK A3002R 3.0.0-B20230809.1615', 'TOTOLINK A3002RU 3.0.0-B20230809.1615']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-4729",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-4729"
    }
  },
  "description": "TOTOLINK A3002R\u548cA3002RU\u662fTOTOLINK\u516c\u53f8\u751f\u4ea7\u7684\u8def\u7531\u5668\uff0c\u652f\u6301\u591a\u79cd\u7f51\u7edc\u529f\u80fd\u548c\u670d\u52a1\u3002\n\nTOTOLINK A3002R\u548cA3002RU\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eHTTP POST\u8bf7\u6c42\u5904\u7406\u7a0b\u5e8f\u7684/boafrm/formMapDelDevice\u6587\u4ef6\u7684\u9519\u8bef\u64cd\u4f5c\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5c1a\u672a\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://m.totolink.net/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-11977",
  "openTime": "2025-06-10",
  "products": {
    "product": [
      "TOTOLINK A3002R 3.0.0-B20230809.1615",
      "TOTOLINK A3002RU 3.0.0-B20230809.1615"
    ]
  },
  "referenceLink": "https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/2.md\r\nhttps://vuldb.com/?ctiid.309031\r\nhttps://vuldb.com/?id.309031\r\nhttps://vuldb.com/?submit.570686\r\nhttps://www.totolink.net/",
  "serverity": "\u4e2d",
  "submitTime": "2025-05-20",
  "title": "TOTOLINK A3002R\u548cA3002RU\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2025-4729 (GCVE-0-2025-4729)

Vulnerability from cvelistv5

Published

2025-05-15 23:31

Modified

2025-05-16 13:18

Severity ?

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-77 - Command Injection
CWE-74 - Injection

Summary

A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

References

▼	URL	Tags
	https://vuldb.com/?id.309031	vdb-entry, technical-description
	https://vuldb.com/?ctiid.309031	signature, permissions-required
	https://vuldb.com/?submit.570686	third-party-advisory
	https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/2.md	broken-link, exploit
	https://www.totolink.net/	product

Impacted products

Vendor

Product

Version

▼

TOTOLINK

A3002R

Version: 3.0.0-B20230809.1615

TOTOLINK

A3002RU

Version: 3.0.0-B20230809.1615

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4729",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T13:18:45.411260Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-16T13:18:50.742Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "A3002R",
          "vendor": "TOTOLINK",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0-B20230809.1615"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "A3002RU",
          "vendor": "TOTOLINK",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0-B20230809.1615"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "BabyShark (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
        },
        {
          "lang": "de",
          "value": "In TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615 wurde eine kritische Schwachstelle ausgemacht. Das betrifft eine unbekannte Funktionalit\u00e4t der Datei /boafrm/formMapDelDevice der Komponente HTTP POST Request Handler. Durch Manipulieren des Arguments macstr mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-15T23:31:06.917Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-309031 | TOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.309031"
        },
        {
          "name": "VDB-309031 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.309031"
        },
        {
          "name": "Submit #570686 | TOTOLINK A3002RU V3/A3002R_V4 V3.0.0-B20230809.1615 Command execution",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.570686"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/2.md"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.totolink.net/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-05-15T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-05-15T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-05-15T09:28:24.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "TOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-4729",
    "datePublished": "2025-05-15T23:31:06.917Z",
    "dateReserved": "2025-05-15T07:23:06.748Z",
    "dateUpdated": "2025-05-16T13:18:50.742Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted