CVE-2020-25499

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 4.20%
EPSS Percentile: 90.73%
CISA KEV: Not listed

Description

TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 10-Dec-2020 04:15
Last Modified: 17-Jun-2026 10:06
EPSS Date: 2026-10-12
CWE: CWE-78, CWE-862

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

totolink / a3002r_firmware
Version / affected range: * · before (exclusive) 1.1.1-b20200824.0128
cpe:2.3:o:totolink:a3002r_firmware:*:*:*:*:*:*:*:*
totolink / a3002ru-v1_firmware
Version / affected range: * · before (exclusive) 3.4.0-b20201030.1754
cpe:2.3:o:totolink:a3002ru-v1_firmware:*:*:*:*:*:*:*:*
totolink / a3002ru-v2_firmware
Version / affected range: * · before (exclusive) 2.1.1-b20200911.1756
cpe:2.3:o:totolink:a3002ru-v2_firmware:*:*:*:*:*:*:*:*
totolink / a702r-v2_firmware
Version / affected range: * · before (exclusive) 1.0.0-b20201028.1743
cpe:2.3:o:totolink:a702r-v2_firmware:*:*:*:*:*:*:*:*
totolink / a702r-v3_firmware
Version / affected range: * · before (exclusive) 1.0.0-b20201103.1713
cpe:2.3:o:totolink:a702r-v3_firmware:*:*:*:*:*:*:*:*
totolink / n100re-v3_firmware
Version / affected range: * · before (exclusive) 3.4.0-b20201030.0926
cpe:2.3:o:totolink:n100re-v3_firmware:*:*:*:*:*:*:*:*
totolink / n150rt_firmware
Version / affected range: * · before (exclusive) 3.4.0-b20201030.1142
cpe:2.3:o:totolink:n150rt_firmware:*:*:*:*:*:*:*:*
totolink / n200re-v3_firmware
Version / affected range: * · before (exclusive) 3.4.0-b20201029.1811
cpe:2.3:o:totolink:n200re-v3_firmware:*:*:*:*:*:*:*:*
totolink / n200re-v4_firmware
Version / affected range: * · before (exclusive) 4.0.0-b20200805.1507
cpe:2.3:o:totolink:n200re-v4_firmware:*:*:*:*:*:*:*:*
totolink / n210re_firmware
Version / affected range: * · before (exclusive) 1.0.0-b20201030.2030
cpe:2.3:o:totolink:n210re_firmware:*:*:*:*:*:*:*:*
totolink / n300rh-v3_firmware
Version / affected range: * · before (exclusive) 3.2.4-b20201029.1838
cpe:2.3:o:totolink:n300rh-v3_firmware:*:*:*:*:*:*:*:*
totolink / n300rt_firmware
Version / affected range: * · before (exclusive) 3.4.0-b20201026.2033
cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*
totolink / n302r_plus_firmware
Version / affected range: * · before (exclusive) 3.4.0-b20201028.2224
cpe:2.3:o:totolink:n302r_plus_firmware:*:*:*:*:*:*:*:*

References

Last enrichment sync: 13-Oct-2026 04:54
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2020-25499 Recorded Future Identifies 85 High-Impact Vulnerabilities in July, Many Actively Exploited

CVE (80)

Malware (4)

Threat Actors (8)

Vendors (25)

Products (70)

Tools (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.