CVE-2025-9779
Published: 01 September 2025
Summary
CVE-2025-9779 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink A702R Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the ip6addr argument in the formFilter function to prevent buffer overflow from invalid input manipulation.
Requires timely remediation of the identified buffer overflow flaw via firmware patching to eliminate the vulnerability.
Provides memory protections such as stack canaries, ASLR, and DEP to mitigate successful buffer overflow exploitation leading to code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web form (/boafrm/formFilter) on network-exposed router enables remote exploitation of public-facing application for arbitrary code execution.
NVD Description
A vulnerability was detected in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this vulnerability is the function sub_4162DC of the file /boafrm/formFilter. The manipulation of the argument ip6addr results in buffer overflow. It is possible to launch the attack remotely. The exploit…
more
is now public and may be used.
Deeper analysisAI
CVE-2025-9779 is a buffer overflow vulnerability (CWE-119, CWE-120) in the TOTOLINK A702R router firmware version 4.0.0-B20211108.1423. The flaw affects the sub_4162DC function in the /boafrm/formFilter file, where manipulation of the ip6addr argument triggers the overflow. Published on 2025-09-01, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation leads to high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution or system compromise on the affected router.
References point to a public proof-of-concept exploit on GitHub, including detailed exploitation steps, as well as VulDB entries documenting the issue. No vendor advisories or patches are specified in the available information.
The exploit is public and available for use, heightening the risk of real-world attacks against unpatched TOTOLINK A702R devices.
Details
- CWE(s)