CVE-2025-5506

A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been classified as problematic. Affected is an unknown function of the component NAT Mapping Page. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
Link Resource
https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_Nat_Mapping Exploit Third Party Advisory
https://vuldb.com/?ctiid.310920 Permissions Required VDB Entry
https://vuldb.com/?id.310920 Third Party Advisory VDB Entry
https://vuldb.com/?submit.584663 Third Party Advisory VDB Entry
https://www.totolink.net/ Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:totolink:a3002ru_firmware:2.1.1-b20230720.1011:*:*:*:*:*:*:*
cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*

History

17 Jun 2025, 20:40

Type Values Removed Values Added
First Time Totolink a3002ru Firmware
Totolink
Totolink a3002ru
CPE cpe:2.3:o:totolink:a3002ru_firmware:2.1.1-b20230720.1011:*:*:*:*:*:*:*
cpe:2.3:h:totolink:a3002ru:-:*:*:*:*:*:*:*
References () https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_Nat_Mapping - () https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_Nat_Mapping - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.310920 - () https://vuldb.com/?ctiid.310920 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.310920 - () https://vuldb.com/?id.310920 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.584663 - () https://vuldb.com/?submit.584663 - Third Party Advisory, VDB Entry
References () https://www.totolink.net/ - () https://www.totolink.net/ - Product

04 Jun 2025, 14:54

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en TOTOLINK A3002RU 2.1.1-B20230720.1011. Se ha clasificado como problemática. Se ve afectada una función desconocida del componente NAT Mapping Page. La manipulación del argumento "Comment" provoca ataques de Cross-Site Scripting. Es posible ejecutar el ataque de forma remota. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.

03 Jun 2025, 15:16

Type Values Removed Values Added
New CVE

Information

Published : 2025-06-03 15:16

Updated : 2025-06-17 20:40


NVD link : CVE-2025-5506

Mitre link : CVE-2025-5506

CVE.ORG link : CVE-2025-5506


JSON object : View

Products Affected

totolink

  • a3002ru
  • a3002ru_firmware
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')