CVE-2025-9780CWE-119CWE-120

CVE-2025-9780

High · published September 1, 2025

CVSS v3.1

8.8

EPSS

Percentile

51.1

In the wild

Unconfirmed

What it is

A flaw has been found in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this issue is the function sub_419BE0 of the file /boafrm/formIpQoS. This manipulation of the argument mac causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00664 · 51.1th percentile
Weaknesses: CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published: 2025-09-01T17:15Z

Affected products (1)

Product	Versions	Fixed in
totolink/a702r_firmware	all versions	—

References (6)

https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formIpQoS/formIpQoS.md · [email protected]https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formIpQoS/formIpQoS.md#poc · [email protected]https://vuldb.com/?ctiid.322082 · [email protected]https://vuldb.com/?id.322082 · [email protected]https://vuldb.com/?submit.640988 · [email protected]https://www.totolink.net/ · [email protected]

EPSS history

Timeline

01 SEP 13:02Z
TOTOLINK A702R formIpQoS sub_419BE0 buffer overflow
cvelistv5