CVE-2025-6487

🗓️ 22 Jun 2025 18:00:15Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 28 Views🌐 WEB

Critical stack-based overflow vulnerability in TOTOLINK A3002R allows remote exploitation.

Reporter	Title	Published	Views	Family All 11
bdu_fstec	The vulnerability of the formRoute() function in the TOTOLINK A3002R router’s software allows a hacker to execute arbitrary code.	23 Jun 202500:00	–	bdu_fstec
circl	CVE-2025-6487	22 Jun 202518:44	–	circl
cnnvd	TOTOLINK A3002R 安全漏洞	22 Jun 202500:00	–	cnnvd
cnvd	TOTOLINK A3002R /boafrm/formRoute File Stack Buffer Overflow Vulnerability	27 Jun 202500:00	–	cnvd
cvelist	CVE-2025-6487 TOTOLINK A3002R formRoute stack-based overflow	22 Jun 202518:00	–	cvelist
euvd	EUVD-2025-18906	3 Oct 202520:07	–	euvd
nvd	CVE-2025-6487	22 Jun 202518:15	–	nvd
osv	CVE-2025-6487	22 Jun 202518:15	–	osv
ptsecurity	PT-2025-26566 · Totolink · Totolink A3002Ru	19 Jun 202500:00	–	ptsecurity
redhatcve	CVE-2025-6487	24 Jun 202518:38	–	redhatcve

NVD

Node

AND

totolink a3002r_firmwareMatch1.1.1-b20200824.0128

totolink a3002rMatch-

[
  {
    "vendor": "TOTOLINK",
    "product": "A3002R",
    "versions": [
      {
        "version": "1.1.1-B20200824.0128",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/wudipjq/my_vuln/blob/main/totolink3/vuln_36/36.md
totolink	www.totolink.net/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
subnet	request body	/boafrm/formRoute	Stack-based buffer overflow in formRoute via manipulated subnet parameter (remote exploit possible).	CWE-121, CWE-119

17 Jun 2026 10:02Current

8.9High risk

Vulners AI Score8.9

CVSS 48.7

CVSS 3.18.8

CVSS 29

CVSS 38.8

EPSS0.00776

SSVC