CVE-2020-25499: OS Command Injection

Q: What is the severity of CVE-2020-25499?

CVE-2020-25499 is classified as a high severity vulnerability due to its potential for arbitrary command execution.

Q: How do I fix CVE-2020-25499?

To fix CVE-2020-25499, update the affected TOTOLINK A3002RU firmware to a version higher than 2.1.1-b20200911.1756.

Q: Who is affected by CVE-2020-25499?

CVE-2020-25499 affects users of TOTOLINK A3002RU firmware versions from 1.1.1-b20200824.0128 and below.

Q: What can attackers do with CVE-2020-25499?

Attackers exploiting CVE-2020-25499 can execute arbitrary operating system commands remotely on the vulnerable router.

Q: Is there a workaround for CVE-2020-25499?

Currently, the recommended action for CVE-2020-25499 is to update the firmware, as there are no effective workarounds to mitigate the vulnerability.

Published Dec 9, 2020

Updated

TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.

Affected Software

26 affected components

TOTOLINK A3002R Firmware<1.1.1-b20200824.0128

TOTOLINK A3002R

TOTOLINK A3002ru-v1 Firmware<3.4.0-b20201030.1754

TOTOLINK A3002ru-v1

TOTOLINK A3002ru-v2 Firmware<2.1.1-b20200911.1756

TOTOLINK A3002RU-V2

TOTOLINK A702r-v2 Firmware<1.0.0-b20201028.1743

TOTOLINK A702r-v2

TOTOLINK A702r-v3 Firmware<1.0.0-b20201103.1713

TOTOLINK A702r-v3

TOTOLINK N100re-v3 Firmware<3.4.0-b20201030.0926

TOTOLINK N100re-v3

TOTOLINK N150rt Firmware<3.4.0-b20201030.1142

TOTOLINK N150RT

TOTOLINK N200re-v3 Firmware<3.4.0-b20201029.1811

TOTOLINK N200re-v3

TOTOLINK N200re-v4 Firmware<4.0.0-b20200805.1507

TOTOLINK N200re-v4

TOTOLINK N210re Firmware<1.0.0-b20201030.2030

TOTOLINK N210re

TOTOLINK N300rh-v3 Firmware<3.2.4-b20201029.1838

TOTOLINK N300rh-v3

TOTOLINK N300rt Firmware<3.4.0-b20201026.2033

TOTOLINK N300RT

TOTOLINK N302r Plus Firmware<3.4.0-b20201028.2224

TOTOLINK N302R Plus

Remediation

Patch Available

https://www.totolink.net/home/index/newsss/id/196.html

Event History

Dec 9, 2020

CVE Published

via MITRE·08:30 PM

Data Sourced

via MITRE·08:30 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-25499?

CVE-2020-25499 is classified as a high severity vulnerability due to its potential for arbitrary command execution.

How do I fix CVE-2020-25499?

To fix CVE-2020-25499, update the affected TOTOLINK A3002RU firmware to a version higher than 2.1.1-b20200911.1756.

Who is affected by CVE-2020-25499?