{"id":43517,"date":"2025-05-24T02:24:24","date_gmt":"2025-05-24T02:24:24","guid":{"rendered":""},"modified":"2025-05-29T18:36:35","modified_gmt":"2025-05-30T00:36:35","slug":"cve-2025-4829-critical-buffer-overflow-vulnerability-in-totolink-http-post-request-handler","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-4829-critical-buffer-overflow-vulnerability-in-totolink-http-post-request-handler\/","title":{"rendered":"CVE-2025-4829: Critical Buffer Overflow Vulnerability in TOTOLINK HTTP POST Request Handler<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

A critical vulnerability, CVE-2025-4829, has been identified in TOTOLINK A702R, A3002R, and A3002RU 3.0.0-B20230809.1615. This vulnerability is significant due to its potential impact on the security of these devices, which could lead to system compromise or data leakage. It affects the HTTP POST Request Handler component of these TOTOLINK<\/a> products, and specifically the function sub_40BE30 of the file \/boafrm\/formStats. By manipulating the argument “submit-url”, a buffer overflow<\/a> can be triggered, allowing the attacker to execute arbitrary code on the system.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-4829
\nSeverity: Critical (8.8\/10 CVSS score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system<\/a> compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n