CVE-2025-55591
Published: 18 August 2025
Summary
CVE-2025-55591 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A3002R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates command injection by requiring validation of the devicemac parameter to reject malicious inputs before execution.
Restricts the devicemac input to expected MAC address formats and lengths, blocking oversized or malformed payloads used in command injection.
Requires timely identification, reporting, and patching of the specific command injection flaw in the router firmware version.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in web endpoint (formMapDel/devicemac) enables exploitation of public-facing application (T1190) and command execution on network device CLI (T1059.008).
NVD Description
TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint.
Deeper analysisAI
CVE-2025-55591 is a command injection vulnerability (CWE-77) affecting the TOTOLINK A3002R router in version v4.0.0-B20230531.1404. The issue exists in the devicemac parameter within the formMapDel endpoint, allowing attackers to inject and execute arbitrary operating system commands. Published on 2025-08-18, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and comprehensive impact potential.
Remote attackers require no privileges, authentication, or user interaction to exploit the vulnerability over the network with low complexity. Successful exploitation enables arbitrary command execution on the underlying system, resulting in high impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification of device configurations, or denial of service.
A proof-of-concept exploit is publicly available on GitHub at https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20Command%20Injection/PoC%202.md. No vendor advisories, patches, or official mitigation guidance are referenced in the available information.
Details
- CWE(s)