CVE-2025-8138
Published: 25 July 2025
Summary
CVE-2025-8138 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink A702R Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A vulnerability identified as CVE-2025-8138 affects the TOTOLINK A702R router running firmware version 4.0.0-B20230721.1521. It is present in an unspecified function of the file /boafrm/formOneKeyAccessButton that belongs to the HTTP POST Request Handler component. The flaw is triggered by improper handling of the submit-url argument, resulting in a buffer overflow condition classified under CWE-119 and CWE-120.
An authenticated remote attacker can send a crafted HTTP POST request to exploit the issue and achieve arbitrary code execution or a denial of service on the device. The attack requires no user interaction beyond valid credentials and has a CVSS 4.0 score of 7.4 reflecting high impact on confidentiality, integrity, and availability.
Public exploit code has been disclosed via GitHub, and the EPSS score has remained low and essentially flat near 0.014 since publication, indicating limited observed exploitation interest to date. The vendor website is referenced among the advisories, though no specific mitigation steps or patch availability details are provided in the current references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22578
Vulnerability details
A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formOneKeyAccessButton of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer…
more
overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated buffer overflow in the router's public-facing web management interface (/boafrm/formOneKeyAccessButton) enables exploitation for initial access (T1190) and denial of service via application exploitation (T1499.004), with public PoC available.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates the submit-url argument in the HTTP POST request handler to prevent buffer overflow triggered by malformed inputs.
Implements memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of the buffer overflow for arbitrary code execution.
Requires timely remediation of the known buffer overflow flaw through firmware updates or patches for the TOTOLINK A702R router.