What is the CVSS score of EUVD-2025-18906?

EUVD-2025-18906 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of A3002r Firmware are affected by EUVD-2025-18906?

A critical remote code execution vulnerability affects TOTOLIK A3002R routers (firmware 1.1.1-B20200824.0128) that allows unauthenticated attackers to execute arbitrary code through a stack buffer…

Is there a public PoC exploit available for EUVD-2025-18906?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18906. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2025-18906?

Within 24 hours: Identify all TOTOLIK A3002R devices in use and isolate them from production networks if possible; restrict administrative access to the device's web interface via network segmentation or firewall rules. Within 7 days: Check TOTOLIK support for any available firmware updates or security advisories; if no patch exists, develop a device replacement plan prioritized by criticality. Within 30 days: Replace affected devices with patched alternatives or vendors with confirmed security support; document all deployed TOTOLIK devices in your asset inventory to prevent future gaps.

A3002r Firmware EUVD-2025-18906

| CVE-2025-6487 HIGH

Buffer Overflow (CWE-119)

2025-06-22 cna@vuldb.com

Buffer Overflow TP-Link Stack Overflow RCE A3002r Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 21:55 euvd

EUVD-2025-18906

Analysis Generated

Mar 15, 2026 - 21:55 vuln.today

PoC Detected

Jul 07, 2025 - 18:50 vuln.today

Public exploit code

CVE Published

Jun 22, 2025 - 18:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been rated as critical. This issue affects the function formRoute of the file /boafrm/formRoute. The manipulation of the argument subnet leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6487 is a critical stack-based buffer overflow vulnerability in TOTOLINK A3002R router firmware version 1.1.1-B20200824.0128, affecting the formRoute function's subnet parameter processing. An authenticated remote attacker can exploit this to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The vulnerability has public exploit disclosure and should be treated as actively exploitable.

Technical ContextAI

This vulnerability exists in the web-based router management interface of TOTOLINK A3002R, specifically in the /boafrm/formRoute endpoint which handles routing configuration. The vulnerability is rooted in CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack-based buffer overflow where the subnet parameter is not properly validated before being written to a fixed-size stack buffer. The affected device is a residential WiFi router (802.11n/ac), and the vulnerable code path is likely in embedded C/C++ firmware handling HTTP form submissions. The attack surface includes the router's administrative web interface, which typically runs as root with high privileges.

RemediationAI

Check TOTOLINK support website for firmware updates beyond 1.1.1-B20200824.0128. Contact TOTOLINK directly for security update availability and timeline.; priority: Critical - Apply immediately upon availability Workaround: Restrict access to router administrative interface: (1) Change default admin credentials to strong, unique password; (2) Disable remote management/WAN access to web interface; (3) Use firewall rules to restrict access to /boafrm/formRoute from trusted IPs only; (4) Disable guest WiFi or isolate guest network with ACLs; (5) Update router to most recent available firmware version before this CVE was discovered (if newer versions exist).; effectiveness: Reduces attack surface but does not eliminate vulnerability Network Mitigation: Deploy network segmentation to isolate router management traffic. Implement WAF/IDS rules to detect malformed subnet parameters in HTTP POST requests to /boafrm/formRoute. Monitor router logs for unusual POST requests to this endpoint.; effectiveness: Medium - may detect but not prevent exploitation Device Replacement: If patch is unavailable or delayed, consider replacing TOTOLINK A3002R with alternative router from vendor with active security support.; effectiveness: Eliminates risk entirely