What’s Vulnerable › Vulnerabilities

CVE-2025-5672: TOTOLINK N302R Plus HTTP POST Request formFilter buffer overflow

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-05 · updated 2026-06-17
• Weakness: CWE-119

Description

A vulnerability has been found in TOTOLINK N302R Plus up to 3.4.0-B20201028 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products

• TOTOLINK N302R Plus: before 3.4.0-b20201028 — fixed in 3.4.0-b20201028

How to fix

Upgrade to a fixed version: TOTOLINK N302R Plus 3.4.0-b20201028. Check the vendor advisory for mitigations.

References

• https://github.com/byxs0x0/cve2/blob/main/530/2.md
• https://vuldb.com/?ctiid.311161
• https://vuldb.com/?id.311161
• https://vuldb.com/?submit.590094
• https://www.totolink.net/

Get alerted when CVE-2025-5672 or the next vulnerability affects your stack