CVE-2020-25499
High
Description
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
SeverityHigh
CVSS8.8
Exploit probability—
ProductTotolink A3002r Firmware
PublishedDec 9, 2020
First seenDec 9, 2020
How to fix
Update
- totolink a3002r_firmware1.1.1-b20200824.0128 or later
- totolink a3002ru-v1_firmware3.4.0-b20201030.1754 or later
- totolink a3002ru-v2_firmware2.1.1-b20200911.1756 or later
- totolink a702r-v2_firmware1.0.0-b20201028.1743 or later
- totolink a702r-v3_firmware1.0.0-b20201103.1713 or later
- totolink n100re-v3_firmware3.4.0-b20201030.0926 or later
- totolink n150rt_firmware3.4.0-b20201030.1142 or later
- totolink n200re-v3_firmware3.4.0-b20201029.1811 or later
- totolink n200re-v4_firmware4.0.0-b20200805.1507 or later
- totolink n210re_firmware1.0.0-b20201030.2030 or later
- totolink n300rh-v3_firmware3.2.4-b20201029.1838 or later
- totolink n300rt_firmware3.4.0-b20201026.2033 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| totolink a3002r_firmware | v < 1.1.1-b20200824.0128 | 1.1.1-b20200824.0128 |
| totolink a3002ru-v1_firmware | v < 3.4.0-b20201030.1754 | 3.4.0-b20201030.1754 |
| totolink a3002ru-v2_firmware | v < 2.1.1-b20200911.1756 | 2.1.1-b20200911.1756 |
| totolink a702r-v2_firmware | v < 1.0.0-b20201028.1743 | 1.0.0-b20201028.1743 |
| totolink a702r-v3_firmware | v < 1.0.0-b20201103.1713 | 1.0.0-b20201103.1713 |
| totolink n100re-v3_firmware | v < 3.4.0-b20201030.0926 | 3.4.0-b20201030.0926 |
| totolink n150rt_firmware | v < 3.4.0-b20201030.1142 | 3.4.0-b20201030.1142 |
| totolink n200re-v3_firmware | v < 3.4.0-b20201029.1811 | 3.4.0-b20201029.1811 |
| totolink n200re-v4_firmware | v < 4.0.0-b20200805.1507 | 4.0.0-b20200805.1507 |
| totolink n210re_firmware | v < 1.0.0-b20201030.2030 | 1.0.0-b20201030.2030 |
| totolink n300rh-v3_firmware | v < 3.2.4-b20201029.1838 | 3.2.4-b20201029.1838 |
| totolink n300rt_firmware | v < 3.4.0-b20201026.2033 | 3.4.0-b20201026.2033 |
| totolink n302r_plus_firmware | v < 3.4.0-b20201028.2224 | 3.4.0-b20201028.2224 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.