CVE-2025-25635
Published: 28 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-25635 is a buffer overflow vulnerability (CWE-120) affecting the TOTOlink A3002R router in version V1.1.1-B20200824.0128. The issue arises from improper input validation of the pppoe_dns1 parameter in the formIpv6Setup interface, which is handled by the /bin/boa web server component. Published on 2025-02-28, it carries a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An adjacent network attacker (AV:A) with low privileges (PR:L), such as an authenticated user, can exploit the vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N). Successful exploitation allows high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service (C:H/I:H/A:H), likely enabling remote code execution on the affected device.
A proof-of-concept and technical details are documented in a GitHub repository at https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/TOTOLINK-A3002R-formIpv6Setup-pppoe_dns1.md. No official vendor advisories or patches are referenced in the CVE details.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Buffer overflow in the public-facing web interface (/bin/boa formIpv6Setup pppoe_dns1 parameter) enables remote code execution via exploitation of a public-facing application.