CVE-2025-70329

This vulnerability allows an authenticated attacker to run any shell command on the device by exploiting a flaw in how the system handles time synchronization input. Although the first part of the input is checked, the rest can be manipulated, giving attackers the ability to execute harmful commands if they have access to the system.

This vulnerability allows an attacker with access to the device to inject harmful commands into the system's ping utility, which can lead to the device becoming unresponsive or overloaded. The attacker can exploit this by sending specially crafted input that the device does not properly check, making it a serious risk for devices running the affected firmware.

This vulnerability allows an attacker to execute arbitrary code on the TOTOLINK A3002RU router, potentially taking full control of the device. It occurs when the router processes a specially crafted input related to IPv6 settings, meaning an attacker needs to have access to the router's configuration interface to exploit it.

This vulnerability allows an attacker to execute malicious code on the TOTOLINK A3002RU router by sending specially crafted input through the vpnUser or vpnPassword fields. To exploit this, the attacker needs access to the router's web interface, which typically requires being on the same network.

This vulnerability allows an attacker to execute arbitrary code on the TOTOLINK A3002RU router by sending specially crafted data through the router name parameter. It requires the attacker to have access to the router's web interface, which could be exploited if the router is exposed to the internet or if an attacker is on the same local network.