CVE-2025-25635
Published: 28 February 2025
Summary
CVE-2025-25635 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Totolink A3002R Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of inputs like the pppoe_dns1 parameter to prevent buffer overflows from improper input handling in the formIpv6Setup interface.
Mandates timely identification, reporting, and correction of the specific buffer overflow flaw in the /bin/boa web server component.
Provides memory protection mechanisms like address space layout randomization or non-executable stacks to mitigate exploitation of the buffer overflow for code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the public-facing web interface (/bin/boa formIpv6Setup pppoe_dns1 parameter) enables remote code execution via exploitation of a public-facing application.
NVD Description
TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the pppoe_dns1 parameter in the formIpv6Setup interface of /bin/boa.
Deeper analysisAI
CVE-2025-25635 is a buffer overflow vulnerability (CWE-120) affecting the TOTOlink A3002R router in version V1.1.1-B20200824.0128. The issue arises from improper input validation of the pppoe_dns1 parameter in the formIpv6Setup interface, which is handled by the /bin/boa web server component. Published on 2025-02-28, it carries a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An adjacent network attacker (AV:A) with low privileges (PR:L), such as an authenticated user, can exploit the vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N). Successful exploitation allows high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service (C:H/I:H/A:H), likely enabling remote code execution on the affected device.
A proof-of-concept and technical details are documented in a GitHub repository at https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/TOTOLINK-A3002R-formIpv6Setup-pppoe_dns1.md. No official vendor advisories or patches are referenced in the CVE details.
Details
- CWE(s)