CVE-2025-6337
Published: 20 June 2025
Summary
CVE-2025-6337 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink A3002Ru Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability has been identified in TOTOLINK A3002R and A3002RU devices running firmware versions 3.0.0-B20230809.1615 and 4.0.0-B20230531.1404. The flaw resides in an unspecified function of the file /boafrm/formTmultiAP inside the HTTP POST Request Handler component. Manipulation of the submit-url argument triggers a buffer overflow, tracked as CWE-119 and CWE-120, and carries a CVSS 4.0 score of 7.4 with network attack vector and low attack complexity.
An authenticated remote attacker can send a crafted HTTP POST request to the affected endpoint to trigger the overflow. Successful exploitation grants the ability to execute arbitrary code or crash the service, resulting in high impact to confidentiality, integrity, and availability on the device. Public proof-of-concept code has been released.
The associated EPSS score remains low at 0.0148 with a peak of 0.0149, indicating limited observed exploitation interest to date. No vendor advisory or patch information is referenced in the available disclosures.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28720
Vulnerability details
A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615/4.0.0-B20230531.1404. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formTmultiAP of the component HTTP POST Request Handler. The manipulation of the argument…
more
submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The buffer overflow vulnerability in the public-facing HTTP POST handler (/boafrm/formTmultiAP) of the TOTOLINK router web interface enables remote exploitation for initial access, with public PoC exploits available.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.