Volerion logoVolerion
Volerion logoVolerion

TOTOLINK A3002R OS Command Injection Vulnerability

Vulnerability

A critical OS command injection vulnerability has been identified in the TOTOLINK A3002R router running firmware version 1.1.1-B20200824.0128. The issue arises in the 'formWlSiteSurvey' function of the '/boafrm/formWlSiteSurvey' file, where the 'wlanif' argument can be manipulated to execute arbitrary OS commands. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows remote attackers to execute arbitrary operating system commands on the affected device.

Added: Jun 22, 2025, 5:26 PM
Updated: Jun 22, 2025, 5:26 PM

Vulnerability Rating

Custom Algorithm
spread
2.6
impact
10.0
exploitability
6.2
remediation
0.0
relevance
0.2
threat
6.6
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.