What is the CVSS score of CVE-2025-6486?

CVE-2025-6486 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of A3002r Firmware are affected by CVE-2025-6486?

A critical remote code execution vulnerability in TOTOLINK A3002R routers (CVE-2025-6486) poses significant risk to organizations using this device, as exploitation requires no authentication and a…

Is there a public PoC exploit available for CVE-2025-6486?

Yes, a public proof-of-concept exploit is available for CVE-2025-6486. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-6486?

Within 24 hours: Inventory all TOTOLIK A3002R devices running firmware 1.1.1-B20200824.0128 and isolate affected units from production networks if possible; implement network segmentation to restrict access to the /boafrm/formWlanMultipleAP endpoint. Within 7 days: Contact TOTOLINK for patch availability and ETA; deploy WAF rules to block malicious submit-url payloads; consider replacing devices with patched alternatives if vendor support is unavailable. Within 30 days: Complete device remediation through patching or replacement; conduct network forensics to detect potential exploitation; implement enhanced monitoring on remaining devices.

A3002r Firmware CVE-2025-6486

EUVD-2025-18854 HIGH

Buffer Overflow (CWE-119)

2025-06-22 cna@vuldb.com

Buffer Overflow TP-Link RCE A3002r Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 21:55 euvd

EUVD-2025-18854

Analysis Generated

Mar 15, 2026 - 21:55 vuln.today

PoC Detected

Jul 07, 2025 - 18:49 vuln.today

Public exploit code

CVE Published

Jun 22, 2025 - 18:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6486 is a critical stack-based buffer overflow vulnerability in TOTOLINK A3002R router firmware version 1.1.1-B20200824.0128, affecting the formWlanMultipleAP function. An authenticated remote attacker can exploit this via manipulation of the 'submit-url' parameter to achieve code execution with high impact on confidentiality, integrity, and availability. Public exploit code is available, increasing real-world exploitation risk.

Technical ContextAI

This vulnerability exists in the web-based management interface of the TOTOLINK A3002R wireless router. The vulnerable endpoint is /boafrm/formWlanMultipleAP, which processes wireless LAN multiple access point configurations through the Boa web server. The vulnerability stems from a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) stack-based buffer overflow in the 'submit-url' parameter handling. The affected product is identified as TOTOLINK A3002R firmware version 1.1.1-B20200824.0128 (CPE: likely cpe:2.3:o:totolink:a3002r_firmware:1.1.1-b20200824.0128:*:*:*:*:*:*:*). The vulnerability indicates insufficient bounds checking when copying user-supplied input into fixed-size stack buffers, allowing attackers to overwrite the stack and potentially execute arbitrary code.

RemediationAI

Check TOTOLINK A3002R support/download page for firmware versions newer than 1.1.1-B20200824.0128. Apply available firmware updates immediately if accessible. Network Mitigation: Restrict access to the router management interface (/boafrm/*) to trusted networks only. Implement firewall rules to block external access to the router's web management port (default 80/443 or 8080). Authentication Hardening: Change default administrative credentials to strong, unique passwords. Consider disabling remote management features if not required. Monitoring: Monitor for suspicious POST requests to /boafrm/formWlanMultipleAP endpoint with unusual 'submit-url' parameter values. Enable logging on the router if available. Vendor Advisory: Consult TOTOLINK security advisories or contact vendor support at totolink.net for patch availability and upgrade paths.