What’s Vulnerable › Vulnerabilities

CVE-2020-25499

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-12-09 · updated 2026-06-17
• Weakness: CWE-78

Description

TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.

Affected products

• TOTOLINK A3002R: before 1.1.1-b20200824.0128 — fixed in 1.1.1-b20200824.0128
• TOTOLINK A3002Ru-V1 Firmware: before 3.4.0-b20201030.1754 — fixed in 3.4.0-b20201030.1754
• TOTOLINK A3002Ru-V2 Firmware: before 2.1.1-b20200911.1756 — fixed in 2.1.1-b20200911.1756
• TOTOLINK A702R-V2 Firmware: before 1.0.0-b20201028.1743 — fixed in 1.0.0-b20201028.1743
• TOTOLINK A702R-V3 Firmware: before 1.0.0-b20201103.1713 — fixed in 1.0.0-b20201103.1713
• TOTOLINK N100Re-V3 Firmware: before 3.4.0-b20201030.0926 — fixed in 3.4.0-b20201030.0926
• TOTOLINK N150RT: before 3.4.0-b20201030.1142 — fixed in 3.4.0-b20201030.1142
• TOTOLINK N200Re-V3 Firmware: before 3.4.0-b20201029.1811 — fixed in 3.4.0-b20201029.1811
• TOTOLINK N200Re-V4 Firmware: before 4.0.0-b20200805.1507 — fixed in 4.0.0-b20200805.1507
• TOTOLINK N210Re Firmware: before 1.0.0-b20201030.2030 — fixed in 1.0.0-b20201030.2030
• TOTOLINK N300Rh-V3 Firmware: before 3.2.4-b20201029.1838 — fixed in 3.2.4-b20201029.1838
• TOTOLINK N300Rt Firmware: before 3.4.0-b20201026.2033 — fixed in 3.4.0-b20201026.2033
• TOTOLINK N302R Plus: before 3.4.0-b20201028.2224 — fixed in 3.4.0-b20201028.2224

How to fix

Upgrade to a fixed version: TOTOLINK A3002R 1.1.1-b20200824.0128; TOTOLINK A3002Ru-V1 Firmware 3.4.0-b20201030.1754; TOTOLINK A3002Ru-V2 Firmware 2.1.1-b20200911.1756; TOTOLINK A702R-V2 Firmware 1.0.0-b20201028.1743; TOTOLINK A702R-V3 Firmware 1.0.0-b20201103.1713; TOTOLINK N100Re-V3 Firmware 3.4.0-b20201030.0926; TOTOLINK N150RT 3.4.0-b20201030.1142; TOTOLINK N200Re-V3 Firmware 3.4.0-b20201029.1811; TOTOLINK N200Re-V4 Firmware 4.0.0-b20200805.1507; TOTOLINK N210Re Firmware 1.0.0-b20201030.2030; TOTOLINK N300Rh-V3 Firmware 3.2.4-b20201029.1838; TOTOLINK N300Rt Firmware 3.4.0-b20201026.2033. Check the vendor advisory for mitigations.

References

• https://github.com/kdoos/Vulnerabilities/blob/main/RCE_TOTOLINK-A3002RU-V2
• https://www.totolink.net/home/index/newsss/id/196.html
• https://github.com/kdoos/Vulnerabilities/blob/main/RCE_TOTOLINK-A3002RU-V2
• https://www.totolink.net/home/index/newsss/id/196.html

Get alerted when CVE-2020-25499 or the next vulnerability affects your stack