CVE-2025-6940

🗓️ 01 Jul 2025 02:32:07Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 48 Views🌐 WEB

Critical buffer overflow vulnerability in TOTOLINK A702R's HTTP POST Request Handler disclosed.

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the request processing function in TOTOLINK A702R router microprogramming software allows a intruder to trigger a service failure.	2 Jul 202500:00	–	bdu_fstec
Circl	CVE-2025-6940	1 Jul 202503:10	–	circl
CNNVD	TOTOLINK A702r 安全漏洞	1 Jul 202500:00	–	cnnvd
CNVD	TOTOLINK A702r Buffer Overflow Vulnerability	4 Jul 202500:00	–	cnvd
Cvelist	CVE-2025-6940 TOTOLINK A702R HTTP POST Request formParentControl buffer overflow	1 Jul 202502:32	–	cvelist
EUVD	EUVD-2025-19600	3 Oct 202520:07	–	euvd
NVD	CVE-2025-6940	1 Jul 202503:15	–	nvd
OSV	CVE-2025-6940	1 Jul 202503:15	–	osv
Positive Technologies	PT-2025-27504 · Totolink · Totolink A702R	28 Jun 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-6940: Buffer Copy without Checking Size of Input	1 Jul 202500:00	–	rapid7

NVD

Vulners

Node

AND

totolink a702r_firmwareMatch4.0.0-b20230721.1521

totolink a702rMatch-

[
  {
    "vendor": "TOTOLINK",
    "product": "A702R",
    "versions": [
      {
        "version": "4.0.0-B20230721.1521",
        "status": "affected"
      }
    ],
    "modules": [
      "HTTP POST Request Handler"
    ]
  }
]

Source	Link
totolink	www.totolink.net/
github	www.github.com/awindog/cve/blob/main/688/27.md
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/awindog/cve/blob/main/688/27.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
submit-url	request body	/boafrm/formParentControl	Buffer overflow in POST /boafrm/formParentControl triggered by the submit-url parameter in the request body.	CWE-119, CWE-120

17 Jun 2026 10:02Current

7.9High risk

Vulners AI Score7.9

CVSS 48.7

CVSS 3.18.8

CVSS 38.8

CVSS 29

EPSS0.00961

SSVC