Cyber Posture

CVE-2025-25579

CriticalPublic PoC

Published: 28 March 2025

Published
28 March 2025
Modified
07 April 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1942 95.4th percentile
Risk Priority 31 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-25579 is a command injection vulnerability (CWE-78) affecting the TOTOLINK A3002R router running firmware version V4.0.0-B20230531.1404. The flaw resides in the /bin/boa component and is triggered via the "bandstr" parameter, allowing attackers to inject operating system commands. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.

Any unauthenticated attacker with network access to the affected device can exploit this vulnerability without user interaction or privileges. Successful exploitation enables remote command execution, granting full control over the router, including data exfiltration, modification of configurations, or disruption of services.

Proof-of-concept exploits are available in public repositories, such as https://gist.github.com/regainer27/0abf6f56eae3fa2826d2551e22c2ace3 and https://github.com/regainer27/totolink_A3002R_remote_command_exec, demonstrating remote command execution capabilities. No official vendor advisories or patches are detailed in the available references.

Details

CWE(s)
CWE-78

Affected Products

totolink
a3002r firmware
4.0.0-b20230531.1404

MITRE ATT&CK Enterprise Techniques

T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a remote unauthenticated OS command injection via the web interface (boa) on a network device (router), enabling exploitation of a public-facing application (T1190) and command/script execution using the network device CLI/interpreter (T1059.008).

References