CVE-2020-25499
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's ...
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
- Record
CVE-2020-25499- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-78, CWE-862
- Updated
- 2026-11-02
CVE List No score
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
- Record
CVE-2020-25499- Updated
- 2026-11-02
EUVDEUVD-2020-18184 No score
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
- Record
EUVD-2020-18184- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g4mx-vhr8-g9g7 No score
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's ...
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
- Record
GHSA-g4mx-vhr8-g9g7- Weakness
- CWE-77
- Updated
- 2026-11-02
Affected products
- totolink a3002r firmware
- totolink a3002ru-v1 firmware
- totolink a3002ru-v2 firmware
- totolink a702r-v2 firmware
- totolink a702r-v3 firmware
- totolink n100re-v3 firmware
- totolink n150rt firmware
- totolink n200re-v3 firmware
- totolink n200re-v4 firmware
- totolink n210re firmware
- totolink n300rh-v3 firmware
- totolink n300rt firmware
Show 1 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-25499 is a high vulnerability (CVSS 8.8) in Totolink A3002r Firmware, published December 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.20%, the 91st percentile. No source names a fixed version.