Which versions of TOTOLINK A3002R are affected by CVE-2025-6485?

Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6485, a command injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2025-6485?

Yes, a public proof-of-concept exploit is available for CVE-2025-6485. Prioritise patching immediately. EPSS: 3.7%.

How to fix or mitigate CVE-2025-6485?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

TOTOLINK A3002R CVE-2025-6485

Q: What is the CVSS score of CVE-2025-6485?

CVE-2025-6485 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 3.7%.

EUVD-2025-18852 LOW

Command Injection (CWE-77)

2025-06-22 cna@vuldb.com

Command Injection A3002r Firmware

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Command injection leads to full compromise; PR:L due to required authentication.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 21:55 euvd

EUVD-2025-18852

Analysis Generated

Mar 15, 2026 - 21:55 vuln.today

PoC Detected

Aug 14, 2025 - 20:27 vuln.today

Public exploit code

CVE Published

Jun 22, 2025 - 17:15 cve.org

LOW 2.1

CVE Published

Jun 22, 2025 - 17:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critical. This affects the function formWlSiteSurvey of the file /boafrm/formWlSiteSurvey. The manipulation of the argument wlanif leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

OS command injection in TOTOLINK A3002R firmware 1.1.1-B20200824.0128 allows authenticated remote attackers to execute arbitrary commands via the wlanif argument in formWlSiteSurvey. Public exploit code exists, and EPSS score of 3.75% (88th percentile) indicates moderate exploitation likelihood.

Technical ContextAI

The vulnerability resides in the formWlSiteSurvey function within /boafrm/formWlSiteSurvey, part of the router's web management interface. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates that user-supplied input to the wlanif parameter is not sanitized before being passed to a system shell. The affected product is TOTOLINK A3002R firmware version 1.1.1-B20200824.0128, as identified by CPE cpe:2.3:o:totolink:a3002r_firmware:1.1.1-b20200824.0128:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch identified at time of analysis. As a workaround, restrict access to the web management interface to trusted networks only, disable remote management if not required, and monitor for suspicious activity. Consider upgrading to a newer firmware version if available from TOTOLINK. Side effects: disabling remote management may reduce convenience for remote administration.