https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-6487.htmlhttps://patchthecve.com/cve/CVE-2025-6487.htmlWed, 17 Jun 2026 10:02:00 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been rated as critical. This issue affects the function formRoute of the file /boafrm/formRoute. The manipulation of the argument subnet leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit hhttps://patchthecve.com/cve/CVE-2025-6486.htmlhttps://patchthecve.com/cve/CVE-2025-6486.htmlWed, 17 Jun 2026 10:01:59 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be https://patchthecve.com/cve/CVE-2025-6485.htmlhttps://patchthecve.com/cve/CVE-2025-6485.htmlWed, 17 Jun 2026 10:01:59 +0000MEDIUM 6.3: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critical. This affects the function formWlSiteSurvey of the file /boafrm/formWlSiteSurvey. The manipulation of the argument wlanif leads to os command injection. It is possible to initiate the attack remotelhttps://patchthecve.com/cve/CVE-2025-6393.htmlhttps://patchthecve.com/cve/CVE-2025-6393.htmlWed, 17 Jun 2026 10:01:47 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B20230809.1615/4.0.0-B20230531.1404/4.0.0-B20230721.1521/4.1.2cu.5232_B20210713. It has been classified as critical. Affected is an unknown function of the file /boafrm/formIPv6Addr of the component HTTP POST Request Handhttps://patchthecve.com/cve/CVE-2025-6337.htmlhttps://patchthecve.com/cve/CVE-2025-6337.htmlWed, 17 Jun 2026 10:01:38 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615/4.0.0-B20230531.1404. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formTmultiAP of the component HTTP POST Request Handler. The manipulation of the argumehttps://patchthecve.com/cve/CVE-2025-6164.htmlhttps://patchthecve.com/cve/CVE-2025-6164.htmlWed, 17 Jun 2026 10:01:18 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A3002R 4.0.0-B20230531.1404. It has been classified as critical. This affects an unknown part of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to inithttps://patchthecve.com/cve/CVE-2025-6149.htmlhttps://patchthecve.com/cve/CVE-2025-6149.htmlWed, 17 Jun 2026 10:01:16 +0000HIGH 8.8: A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20230531.1404. Affected is an unknown function of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch thehttps://patchthecve.com/cve/CVE-2025-4852.htmlhttps://patchthecve.com/cve/CVE-2025-4852.htmlWed, 17 Jun 2026 09:34:09 +0000LOW 2.4: A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the component VPN Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be initiated remotely. The exploihttps://patchthecve.com/cve/CVE-2025-4835.htmlhttps://patchthecve.com/cve/CVE-2025-4835.htmlWed, 17 Jun 2026 09:34:07 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWlanRedirect of the component HTTP POST Request Handler. The manipulation of the argument redirechttps://patchthecve.com/cve/CVE-2025-4834.htmlhttps://patchthecve.com/cve/CVE-2025-4834.htmlWed, 17 Jun 2026 09:34:07 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been classified as critical. Affected is an unknown function of the file /boafrm/formSetLg of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. Ithttps://patchthecve.com/cve/CVE-2025-4833.htmlhttps://patchthecve.com/cve/CVE-2025-4833.htmlWed, 17 Jun 2026 09:34:06 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 and classified as critical. This issue affects some unknown processing of the file /boafrm/formNtp of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. Thhttps://patchthecve.com/cve/CVE-2025-4832.htmlhttps://patchthecve.com/cve/CVE-2025-4832.htmlWed, 17 Jun 2026 09:34:06 +0000HIGH 8.8: A vulnerability has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formDosCfg of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflohttps://patchthecve.com/cve/CVE-2025-4831.htmlhttps://patchthecve.com/cve/CVE-2025-4831.htmlWed, 17 Jun 2026 09:34:06 +0000HIGH 8.8: A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formSiteSurveyProfile of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overhttps://patchthecve.com/cve/CVE-2025-4830.htmlhttps://patchthecve.com/cve/CVE-2025-4830.htmlWed, 17 Jun 2026 09:34:06 +0000HIGH 8.8: A vulnerability, which was classified as critical, has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. Affected by this issue is some unknown functionality of the file /boafrm/formSysCmd of the component HTTP POST Request Handler. The manipulation of the argument submit-url lehttps://patchthecve.com/cve/CVE-2025-4829.htmlhttps://patchthecve.com/cve/CVE-2025-4829.htmlWed, 17 Jun 2026 09:34:06 +0000HIGH 8.8: A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. Affected by this vulnerability is the function sub_40BE30 of the file /boafrm/formStats of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to bufferhttps://patchthecve.com/cve/CVE-2025-4827.htmlhttps://patchthecve.com/cve/CVE-2025-4827.htmlWed, 17 Jun 2026 09:34:06 +0000HIGH 8.8: A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. Affected is an unknown function of the file /boafrm/formSaveConfig of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflowhttps://patchthecve.com/cve/CVE-2025-4826.htmlhttps://patchthecve.com/cve/CVE-2025-4826.htmlWed, 17 Jun 2026 09:34:05 +0000HIGH 8.8: A vulnerability, which was classified as critical, has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects some unknown processing of the file /boafrm/formWirelessTbl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads thttps://patchthecve.com/cve/CVE-2025-4825.htmlhttps://patchthecve.com/cve/CVE-2025-4825.htmlWed, 17 Jun 2026 09:34:05 +0000HIGH 8.8: A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formDMZ of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attachttps://patchthecve.com/cve/CVE-2025-4824.htmlhttps://patchthecve.com/cve/CVE-2025-4824.htmlWed, 17 Jun 2026 09:34:05 +0000HIGH 8.8: A vulnerability classified as critical has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible https://patchthecve.com/cve/CVE-2025-4823.htmlhttps://patchthecve.com/cve/CVE-2025-4823.htmlWed, 17 Jun 2026 09:34:05 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is the function submit-url of the file /boafrm/formReflashClientTbl of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The ahttps://patchthecve.com/cve/CVE-2025-4733.htmlhttps://patchthecve.com/cve/CVE-2025-4733.htmlWed, 17 Jun 2026 09:33:53 +0000HIGH 8.8: A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects some unknown processing of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. Thttps://patchthecve.com/cve/CVE-2025-4732.htmlhttps://patchthecve.com/cve/CVE-2025-4732.htmlWed, 17 Jun 2026 09:33:53 +0000HIGH 8.8: A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr leads to buffer overflow. The attack can bhttps://patchthecve.com/cve/CVE-2025-4731.htmlhttps://patchthecve.com/cve/CVE-2025-4731.htmlWed, 17 Jun 2026 09:33:53 +0000HIGH 8.8: A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type/ip_subnet leads to buffer overflow. It is phttps://patchthecve.com/cve/CVE-2025-4730.htmlhttps://patchthecve.com/cve/CVE-2025-4730.htmlWed, 17 Jun 2026 09:33:53 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads to buffer ovhttps://patchthecve.com/cve/CVE-2025-4729.htmlhttps://patchthecve.com/cve/CVE-2025-4729.htmlWed, 17 Jun 2026 09:33:52 +0000MEDIUM 6.3: A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads thttps://patchthecve.com/cve/CVE-2025-45863.htmlhttps://patchthecve.com/cve/CVE-2025-45863.htmlWed, 17 Jun 2026 09:25:47 +0000CRITICAL 9.8: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the macstr parameter in the formMapDelDevice interface.https://patchthecve.com/cve/CVE-2025-45865.htmlhttps://patchthecve.com/cve/CVE-2025-45865.htmlWed, 17 Jun 2026 09:25:47 +0000CRITICAL 9.8: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the dnsaddr parameter in the formDhcpv6s interface.https://patchthecve.com/cve/CVE-2025-45861.htmlhttps://patchthecve.com/cve/CVE-2025-45861.htmlWed, 17 Jun 2026 09:25:47 +0000CRITICAL 9.8: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the routername parameter in the formDnsv6 interface.https://patchthecve.com/cve/CVE-2025-45858.htmlhttps://patchthecve.com/cve/CVE-2025-45858.htmlWed, 17 Jun 2026 09:25:46 +0000CRITICAL 9.8: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function.https://patchthecve.com/cve/CVE-2025-45867.htmlhttps://patchthecve.com/cve/CVE-2025-45867.htmlWed, 17 Jun 2026 09:25:48 +0000MEDIUM 5.4: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the static_dns1 parameter in the formIpv6Setup interface.https://patchthecve.com/cve/CVE-2025-45866.htmlhttps://patchthecve.com/cve/CVE-2025-45866.htmlWed, 17 Jun 2026 09:25:47 +0000MEDIUM 5.4: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolEnd parameter in the formDhcpv6s interface.https://patchthecve.com/cve/CVE-2025-45864.htmlhttps://patchthecve.com/cve/CVE-2025-45864.htmlWed, 17 Jun 2026 09:25:47 +0000MEDIUM 5.4: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolStart parameter in the formDhcpv6s interface.https://patchthecve.com/cve/CVE-2025-45859.htmlhttps://patchthecve.com/cve/CVE-2025-45859.htmlWed, 17 Jun 2026 09:25:46 +0000MEDIUM 5.4: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the bandstr parameter in the formMapDelDevice interface.https://patchthecve.com/cve/CVE-2025-25579.htmlhttps://patchthecve.com/cve/CVE-2025-25579.htmlWed, 17 Jun 2026 09:00:54 +0000CRITICAL 9.8: TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.https://patchthecve.com/cve/CVE-2025-25635.htmlhttps://patchthecve.com/cve/CVE-2025-25635.htmlWed, 17 Jun 2026 09:00:59 +0000HIGH 8.0: TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the pppoe_dns1 parameter in the formIpv6Setup interface of /bin/boa.https://patchthecve.com/cve/CVE-2025-25610.htmlhttps://patchthecve.com/cve/CVE-2025-25610.htmlWed, 17 Jun 2026 09:00:56 +0000HIGH 8.0: TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_gw parameter in the formIpv6Setup interface of /bin/boa.https://patchthecve.com/cve/CVE-2025-25609.htmlhttps://patchthecve.com/cve/CVE-2025-25609.htmlWed, 17 Jun 2026 09:00:56 +0000HIGH 8.0: TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_ipv6 parameter in the formIpv6Setup interface of /bin/boahttps://patchthecve.com/cve/CVE-2024-54907.htmlhttps://patchthecve.com/cve/CVE-2024-54907.htmlWed, 17 Jun 2026 08:10:46 +0000HIGH 8.8: TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Remote Code Execution in /bin/boa via formWsc.https://patchthecve.com/cve/CVE-2024-34195.htmlhttps://patchthecve.com/cve/CVE-2024-34195.htmlWed, 17 Jun 2026 07:33:02 +0000CRITICAL 9.8: TOTOLINK AC1200 Wireless Router A3002R Firmware V1.1.1-B20200824 is vulnerable to Buffer Overflow. In the boa server program's CGI handling function formWlEncrypt, there is a lack of length restriction on the wlan_ssid field. This oversight leads to potential buffer overflow under specific circumstahttps://patchthecve.com/cve/CVE-2024-42520.htmlhttps://patchthecve.com/cve/CVE-2024-42520.htmlWed, 17 Jun 2026 07:49:36 +0000CRITICAL 9.8: TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl.https://patchthecve.com/cve/CVE-2024-33820.htmlhttps://patchthecve.com/cve/CVE-2024-33820.htmlWed, 17 Jun 2026 07:32:23 +0000HIGH 7.5: Totolink AC1200 Wireless Dual Band Gigabit Router A3002R_V4 Firmware V4.0.0-B20230531.1404 is vulnerable to Buffer Overflow via the formWlEncrypt function of the boa server. Specifically, they exploit the length of the wlan_ssid field triggers the overflow.