What is the CVSS score of CVE-2025-6337?

CVE-2025-6337 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2025-6337?

Yes, a public proof-of-concept exploit is available for CVE-2025-6337. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-6337?

Within 24 hours: Identify and inventory all TOTOLINK A3002R and A3002RU devices in production; isolate affected routers from critical network segments if possible and restrict WAN access. Within 7 days: Implement WAF rules to block POST requests to /boafrm/formTmultiAP with suspicious submit-url parameters; monitor for exploitation attempts in network logs; contact TOTOLINK for patch timeline. Within 30 days: Replace affected routers with patched firmware versions as soon as available, or migrate to alternative router models from vendors with active security support.

A3002r Firmware CVE-2025-6337

EUVD-2025-28720 HIGH

Buffer Overflow (CWE-119)

2025-06-20 cna@vuldb.com

Buffer Overflow TP-Link A3002r Firmware A3002ru Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-119 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	This vulnerability presents exceptionally high real-world risk despite requiring authentication. CVSS 8.8 reflects remote network exploitability (AV:N), low attack complexity (AC:L), and severe impact across all security objectives (C:H/I:H/A:H). The authentication requirement (PR:L) reduces likelihood but does not eliminate it—many users share default credentials or maintain weak passwords on SOHO devices. The public availability of exploit code dramatically increases attack surface and probability of exploitation. While EPSS data is not provided in the submission, the combination of public POC, low complexity, network vector, and widespread consumer deployment makes this a high-priority threat. SSVC framing: Exploitation is active/confirmed (public POC), the vulnerability is likely automatable, and technical impact is total system compromise. This should be treated as priority remediation despite authentication requirement. Real-world risk is HIGH, not mitigated by the authentication gate due to typical weak credential practices on consumer routers.
Exploit ScenarioDerived	An attacker with valid credentials (obtained through credential stuffing, default credentials, or social engineering targeting SOHO users) authenticates to the TOTOLINK router's web management interface (typically 192.168.0.1 or similar). The attacker crafts a malicious HTTP POST request to /boafrm/formTmultiAP with an oversized or specially formatted 'submit-url' parameter exceeding the buffer boundary. The buffer overflow corrupts the stack or heap, allowing the attacker to inject shellcode or redirect execution flow. With low complexity and no additional user interaction required (UI:N), the exploit executes reliably, granting the attacker command execution as the router's root user. From this position, the attacker can modify firewall rules, capture traffic, establish persistent backdoors, or pivot to internal network devices. Given public exploit availability, automated scanning and exploitation of exposed/vulnerable TOTOLINK routers is probable.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

CVE-2025-6337 is a critical buffer overflow vulnerability in TOTOLINK A3002R and A3002RU routers affecting versions 3.0.0-B20230809.1615 and 4.0.0-B20230531.1404. An authenticated attacker can exploit the 'submit-url' parameter in the /boafrm/formTmultiAP HTTP POST handler to achieve remote code execution with complete system compromise (confidentiality, integrity, and availability). Public exploit code exists and the vulnerability is exploitable over the network with low complexity.

RemediationAI

Immediate actions: (1) Check TOTOLINK's official website and security advisory page for patched firmware versions addressing CVE-2025-6337 for A3002R and A3002RU models. (2) If patches are available, update both affected devices immediately via the router's web UI (Settings > Firmware Update) or manual upload of signed firmware binaries. (3) If no patches exist, implement network-level mitigations: disable remote administration access, restrict web UI access to trusted internal IPs only via firewall rules, and enforce strong authentication credentials (change default admin password immediately). (4) Monitor router logs for unauthorized access attempts to /boafrm/formTmultiAP endpoint. (5) Consider isolating affected routers to separate VLAN or network segment if patches are unavailable. Workarounds are limited due to authentication bypass risk; patching is strongly preferred.

Affected VersionsENISA

A3002RU 4.0.0-B20230531.1404

A3002R 3.0.0-B20230809.1615

A3002RU 3.0.0-B20230809.1615

A3002R 4.0.0-B20230531.1404

Affected Packages

euvd a3002r no fix

euvd a3002ru no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the HTTP POST request handler component of TOTOLINK's web administration interface, specifically in the /boafrm/formTmultiAP endpoint. The affected parameter 'submit-url' is improperly validated before being written to a fixed-size buffer, resulting in a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) condition. TOTOLINK A3002R/RU are consumer-grade dual-band WiFi routers commonly deployed in small office/home office (SOHO) environments. The vulnerability exists in the router's web UI authentication framework, requiring an attacker to first authenticate but not requiring elevated privileges (L privilege level). The flaw allows stack-based or heap-based buffer overflow depending on implementation, enabling arbitrary code execution with router privileges.

Know when A3002r Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Aug 01, 2025 - 22:18 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 12:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615/4.0.0-B20230531.1404. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formTmultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Executive ViewAI

Why It Matters

A critical buffer overflow vulnerability in TOTOLIK A3002R/RU routers (CVE-2025-6337) allows unauthenticated remote attackers to compromise affected devices. Organizations using these routers face immediate risk of network infiltration, data exfiltration, and lateral movement into corporate environments, especially if routers are Internet-facing or handle sensitive traffic.

Business Impact: High

Compensating Controls

Implement Web Application Firewall (WAF) rules to block or rate-limit POST requests to /boafrm/formTmultiAP endpoint; 2) Restrict network access to router management interfaces via IP whitelisting and VPN-only access; 3) Disable remote management features if not operationally required; 4) Segment routers on isolated VLANs with minimal lateral movement potential; 5) Enable comprehensive logging and IDS/IPS monitoring for exploitation attempts; 6) Monitor TOTOLINK security advisories daily for patch availability.

Threat Intelligence Overview

EPSS Score

0.6%

Top 31% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.6%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.