CVE-2025-45858

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:totolink:a3002r_firmware:4.0.0-b20230531.1404:*:*:*:*:*:*:*
cpe:2.3:h:totolink:a3002r:-:*:*:*:*:*:*:*

History

23 May 2025, 18:57

Type Values Removed Values Added
CPE cpe:2.3:o:totolink:a3002r_firmware:4.0.0-b20230531.1404:*:*:*:*:*:*:*
cpe:2.3:h:totolink:a3002r:-:*:*:*:*:*:*:*
First Time Totolink
Totolink a3002r
Totolink a3002r Firmware
Summary
  • (es) Se descubrió que TOTOLINK A3002R v4.0.0-B20230531.1404 contiene una vulnerabilidad de inyección de comandos a través de la función FUN_00459fdc.
References () https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/injection1.md - () https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/injection1.md - Exploit, Third Party Advisory
References () https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - () https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - Product

13 May 2025, 19:15

Type Values Removed Values Added
CWE CWE-78
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8
References () https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/injection1.md - () https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/injection1.md -

13 May 2025, 16:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-05-13 16:15

Updated : 2025-05-23 18:57


NVD link : CVE-2025-45858

Mitre link : CVE-2025-45858

CVE.ORG link : CVE-2025-45858


JSON object : View

Products Affected

totolink

  • a3002r_firmware
  • a3002r
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')