EUVD-2025-18887Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents exceptionally high real-world risk when all signals are synthesized: CVSS 8.8 (High) with network-accessible attack vector (AV:N), low attack complexity (AC:L), and requirement for low privilege level (PR:L) indicates broad exploitability. The disclosure of a functional exploit (POC exists and is public) substantially elevates practical risk beyond the CVSS score. The authentication requirement (PR:L) is not a significant mitigating factor in router environments where default credentials are commonplace or weak credentials are prevalent. The CVSS vector C:H/I:H/A:H indicates complete system compromise capability. From an SSVC perspective: exploitation status is PUBLIC with POC available, the attack is likely automatable across affected devices, and technical impact is complete system takeover. This represents a 'critical' priority in SSVC terms. The presence of multiple affected firmware versions across different hardware generations suggests widespread vulnerable devices in production environments globally. Risk is NOT mitigated by the authentication requirement given typical router security postures. |
| Exploit ScenarioDerived | An attacker with access to the router's management interface (obtained via default credentials, credential brute-force, or phishing of an authorized user) sends a crafted HTTP POST request to /boafrm/formIPv6Addr with an abnormally long or specially-crafted 'submit-url' parameter value. This payload overflows a stack or heap buffer in the IPv6 configuration handler, overwriting adjacent memory including function return addresses or other critical data structures. The attacker achieves arbitrary code execution with the privileges of the web server process (typically root in embedded router firmware). With code execution, the attacker can: extract sensitive configuration data and credentials, establish persistence (firmware modification, backdoor installation), pivot to internal network devices, or render the router inoperable (denial of service). Given the public POC availability and PR:L requirement, script-kiddie-level attackers can exploit this at scale against vulnerable TOTOLINK devices on the public internet or within corporate networks where routers are accessible from management VLANs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
CVE-2025-6393 is a critical buffer overflow vulnerability in the HTTP POST request handler of TOTOLINK routers affecting models A702R, A3002R, A3002RU, and EX1200T across multiple firmware versions. An authenticated attacker can exploit this vulnerability by manipulating the 'submit-url' parameter in requests to /boafrm/formIPv6Addr to achieve remote code execution with full system compromise (confidentiality, integrity, and availability impact). The exploit has been publicly disclosed and may be actively exploited in the wild.
RemediationAI
Immediate actions: (1) Check TOTOLINK's official support website and advisory channels for firmware updates addressing CVE-2025-6393 for each affected model; firmware versions released after the identified vulnerable versions should be deployed immediately. (2) If patches are unavailable, implement network-level mitigations: restrict access to the router's administrative interface (typically port 80/443) to trusted IP addresses only via firewall rules, disable remote management if enabled, and enforce strong authentication credentials. (3) Monitor for exploitation attempts targeting the /boafrm/formIPv6Addr endpoint with abnormal 'submit-url' parameter values. (4) For organizations unable to patch immediately, consider deploying intrusion detection signatures targeting POST requests to /boafrm/formIPv6Addr with oversized or malformed submit-url parameters. (5) Prioritize patching as this is a pre-authenticated or low-privilege vulnerability with public POC—treat as highest priority maintenance window. Vendor advisory and patch download links should be obtained directly from TOTOLINK's official support portal to verify authenticity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the HTTP POST request handler component of TOTOLINK firmware, specifically in the /boafrm/formIPv6Addr endpoint. The affected products utilize embedded web server technology (typically uHTTPd or similar lightweight HTTP daemons common in router firmware) for administrative interface management. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating a classic stack or heap buffer overflow where the 'submit-url' parameter lacks proper bounds checking during IPv6 address configuration processing. The vulnerability spans multiple TOTOLINK hardware models (CPE indicators: TOTOLINK A702R, A3002R, A3002RU, EX1200T) with affected firmware versions including 3.0.0-B20230809.1615, 4.0.0-B20230531.1404, 4.0.0-B20230721.1521, and 4.1.2cu.5232_B20210713. This suggests a long-standing code defect present across multiple firmware branches and hardware iterations.
Know when A3002r Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B20230809.1615/4.0.0-B20230531.1404/4.0.0-B20230721.1521/4.1.2cu.5232_B20210713. It has been classified as critical. Affected is an unknown function of the file /boafrm/formIPv6Addr of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A critical remote code execution vulnerability affects TOTOLIK wireless routers (A702R, A3002R, A3002RU, EX1200T) with no vendor patch currently available. Organizations using these devices face immediate risk of unauthorized network access, data theft, and infrastructure compromise since public exploits are already circulating.
Implement Web Application Firewall (WAF) rules to block POST requests to /boafrm/formIPv6Addr endpoint; restrict HTTP/HTTPS management access to trusted IP addresses only via network ACLs; disable remote management features on affected routers; segment router management traffic on isolated VLAN; monitor for exploitation attempts; consider disabling IPv6 configuration functionality if not required for operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in A3002r Firmware
View allTOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
TOTOLINK AC1200 Wireless Router A3002R Firmware V1.1.1-B20200824 is vulnerable to Buffer Overflow. Rated critical severi
TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl. Rated
Critical buffer overflow vulnerability in TOTOLINK A3002R router firmware version 4.0.0-B20230531.1404, affecting the HT
Critical buffer overflow vulnerability in TOTOLINK A3002R firmware version 4.0.0-B20230531.1404 affecting the HTTP POST
CVE-2025-6337 is a critical buffer overflow vulnerability in TOTOLINK A3002R and A3002RU routers affecting versions 3.0.
CVE-2025-6487 is a critical stack-based buffer overflow vulnerability in TOTOLINK A3002R router firmware version 1.1.1-B
CVE-2025-6486 is a critical stack-based buffer overflow vulnerability in TOTOLINK A3002R router firmware version 1.1.1-B
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Remote Code Execution in /bin/boa via formWsc. Rated high severit
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. Rated hig
TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. Rated high severity (CVSS 8.0), this vul
Exploit-DB