CVE-2025-55585: Improper Neutralization of Directives in Dynamically Evaluated Code

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval function...

CVE-2025-55584: Use of Weak Credentials

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account...

CVE-2025-55587: Uncontrolled Resource Consumption

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-55591

TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint...

CVE-2025-55587

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-55588

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fwip parameter at /boafrm/formPortFw. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-55584

The TOTOLINK A3002R router, specifically version 4.0.0-B20230531.1404 , contains insecure credentials for the telnet service and the root account . This vulnerability, categorized under CWE-1391 (Use of Weak Credentials), allows a remote attacker to gain unauthorized access to protected informati...

CVE-2025-55588

The TOTOLINK A3002R router, specifically version 4.0.0-B20230531.1404 , is vulnerable to a buffer overflow in the fw_ip parameter of the /boafrm/formPortFw API endpoint. The root cause is that the input is copied directly to a fixed-length stack buffer without performing length or character check...

CVE-2025-55586

The TOTOLINK A3002R router (version 4.0.0-B20230531.1404 ) contains a buffer overflow vulnerability in the url parameter of the /boafrm/formFilter API endpoint. The root cause is uncontrolled resource consumption , where the software fails to properly limit memory buffer operations. A remote atta...

CVE-2025-55587

The TOTOLINK A3002R wireless router, running firmware version v4.0.0-B20230531.1404 , is vulnerable to a buffer overflow in the hostname parameter of the /boafrm/formMapDelDevice endpoint. This issue, categorized as uncontrolled resource consumption, allows a remote attacker to submit a crafted r...

CVE-2025-55589

The TOTOLINK A3002R wireless router, specifically version v4.0.0-B20230531.1404 , is susceptible to multiple OS command injection vulnerabilities. These flaws exist in the microprogramming software at the /boafrm/formMapDelDevice endpoint, triggered through the macstr , bandstr , and clientoff pa...

CVE-2025-8938

A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet Service. The manipulation of the argument TelEnabled leads to backdoor. The attack may be initiated remotely. The exploit has been disclos...

CVE-2025-8937

A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2025-51452

In TOTOLINK A7000R firmware 9.1.0u.6115B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm...

CVE-2025-51451

In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm...

CVE-2025-8938

A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet Service. The manipulation of the argument TelEnabled leads to backdoor. The attack may be initiated remotely. The exploit has been disclos...

CVE-2025-8937

A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2025-8938

A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet Service. The manipulation of the argument TelEnabled leads to backdoor. The attack may be initiated remotely. The exploit has been disclos...

CVE-2025-8937

A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2025-8938 TOTOLINK N350R Telnet Service formSysTel backdoor

A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet Service. The manipulation of the argument TelEnabled leads to backdoor. The attack may be initiated remotely. The exploit has been disclos...