CVE-2025-9782
📋 TL;DR
This CVE describes a buffer overflow vulnerability in TOTOLINK A702R routers that allows remote attackers to execute arbitrary code by manipulating the submit-url parameter. The vulnerability affects devices running firmware version 4.0.0-B20211108.1423 and can be exploited without authentication. Organizations using these routers are at risk of complete device compromise.
💻 Affected Systems
- TOTOLINK A702R
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, network traffic interception, lateral movement into internal networks, and persistent backdoor installation.
Likely Case
Router takeover enabling network disruption, DNS hijacking, credential theft, and use as botnet node.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on GitHub, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found in provided references
Restart Required: Yes
Instructions:
1. Check TOTOLINK official website for firmware updates. 2. Download latest firmware for A702R model. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router after update completes.
🔧 Temporary Workarounds
Network Access Control
linuxBlock external access to router web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Remote Management
allTurn off remote administration features in router settings
🧯 If You Can't Patch
- Segment affected routers into isolated network zones with strict firewall rules
- Implement network monitoring for unusual traffic patterns to/from router management interfaces
🔍 How to Verify
Check if Vulnerable:
Access router web interface, check firmware version in System Status or About pageCheck Version:
curl -s http://router-ip/boafrm/formSysCmd | grep firmwareVerify Fix Applied:
Verify firmware version has changed from 4.0.0-B20211108.1423 to newer version📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /boafrm/formOneKeyAccessButton
- Large payloads in submit-url parameter
- Multiple failed login attempts followed by buffer overflow patterns
Network Indicators:
- Unusual outbound connections from router
- Traffic to known exploit hosting domains
- HTTP requests with abnormally long submit-url parameters
SIEM Query:
source="router_logs" AND (uri_path="/boafrm/formOneKeyAccessButton" AND content_length>1000)🔗 References
- https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formOneKeyAccessButton/formOneKeyAccessButton.md
- https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formOneKeyAccessButton/formOneKeyAccessButton.md#poc
- https://vuldb.com/?ctiid.322084
- https://vuldb.com/?id.322084
- https://vuldb.com/?submit.640990
- https://www.totolink.net/
