CVE-2025-25579: Command Injection
Published Mar 28, 2025
·Updated
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.
Affected Software
3 affected components
TOTOLINK A3002R
All of the following
TOTOLINK A3002R Firmware=4.0.0-b20230531.1404
TOTOLINK A3002R
Event History
Mar 28, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-25579?
CVE-2025-25579 has been assessed to have a high severity due to its potential for remote command execution.
2
How do I fix CVE-2025-25579?
To fix CVE-2025-25579, it is recommended to update the TOTOLINK A3002R firmware to the latest version that addresses this vulnerability.
3
What kind of attacks are enabled by CVE-2025-25579?
CVE-2025-25579 allows for command injection attacks that could enable an attacker to execute arbitrary commands on the affected device.
4
Which devices are affected by CVE-2025-25579?
CVE-2025-25579 specifically affects the TOTOLINK A3002R router running firmware versions prior to V4.0.0-B20230531.1404.
5
Is CVE-2025-25579 easy to exploit?
Yes, CVE-2025-25579 can be easily exploited due to weak input validation in the device's web interface.