CVE-2025-70328

This vulnerability allows an attacker with access to the device to inject harmful commands into the system's ping utility, which can lead to the device becoming unresponsive or overloaded. The attacker can exploit this by sending specially crafted input that the device does not properly check, making it a serious risk for devices running the affected firmware.

This vulnerability allows an authenticated attacker to run any command on the device with full root access by manipulating certain settings in the firmware. The attacker needs to be logged in to the device to exploit this flaw, making it critical for users to secure their access.

This vulnerability allows an attacker to execute arbitrary code on the TOTOLINK A3002RU router, potentially taking full control of the device. It occurs when the router processes a specially crafted input related to IPv6 settings, meaning an attacker needs to have access to the router's configuration interface to exploit it.

This vulnerability allows an attacker to execute malicious code on the TOTOLINK A3002RU router by sending specially crafted input through the vpnUser or vpnPassword fields. To exploit this, the attacker needs access to the router's web interface, which typically requires being on the same network.

This vulnerability allows an attacker to execute arbitrary code on the TOTOLINK A3002RU router by sending specially crafted data through the router name parameter. It requires the attacker to have access to the router's web interface, which could be exploited if the router is exposed to the internet or if an attacker is on the same local network.