CVE-2025-9780
Published: 01 September 2025
Summary
CVE-2025-9780 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink A702R Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the buffer overflow in sub_419BE0 by applying vendor patches or updates to the TOTOLINK A702R firmware.
Information input validation enforces proper bounds checking and sanitization of the 'mac' argument in /boafrm/formIpQoS to prevent buffer overflow exploitation.
Memory protection mechanisms like ASLR and DEP mitigate successful exploitation of the buffer overflow for arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web form (/boafrm/formIpQoS) on network device directly enables remote exploitation of a public-facing application for code execution.
NVD Description
A flaw has been found in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this issue is the function sub_419BE0 of the file /boafrm/formIpQoS. This manipulation of the argument mac causes buffer overflow. The attack can be initiated remotely. The exploit has been…
more
published and may be used.
Deeper analysisAI
CVE-2025-9780 is a buffer overflow vulnerability affecting the TOTOLINK A702R router on firmware version 4.0.0-B20211108.1423. The flaw exists in the function sub_419BE0 within the /boafrm/formIpQoS file, where manipulation of the 'mac' argument triggers the overflow. This issue, linked to CWE-119 and CWE-120, was published on 2025-09-01 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and without requiring user interaction. Successful exploitation grants high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system compromise.
References include GitHub repositories from rew1X detailing the vulnerability and providing a proof-of-concept exploit, along with VulDB entries documenting the issue (ctiid.322082, id.322082, submit.640988). The published exploit indicates it may be actively usable by attackers.
Details
- CWE(s)