CVE-2025-6149: TOTOLINK A3002R HTTP POST Request formSysLog buffer overflow
A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20230531.1404. Affected is an unknown function of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6149?
CVE-2025-6149 is classified as a critical vulnerability due to its potential for remote code execution through buffer overflow.
How do I fix CVE-2025-6149?
To mitigate CVE-2025-6149, users should update the TOTOLINK A3002R firmware to the latest version that addresses this vulnerability.
What components are affected by CVE-2025-6149?
CVE-2025-6149 affects the HTTP POST Request Handler in the file /boafrm/formSysLog of the TOTOLINK A3002R router.
What kind of attacks can exploit CVE-2025-6149?
Attackers can exploit CVE-2025-6149 to execute arbitrary code remotely through crafted HTTP requests.
Is there a workaround for CVE-2025-6149?
Currently, the recommended workaround for CVE-2025-6149 is to disable remote management features on the TOTOLINK A3002R until a firmware update is available.