Check whether your router is a TOTOLINK A3002R and whether its firmware version matches V4.0.0-B20230531.1404.
If it matches, block remote access to the router (especially any management interfaces exposed beyond your local network) using your firewall rules.
Contact your internet router vendor or check their support page for a fixed firmware release for TOTOLINK A3002R; apply the update as soon as available.
If you cannot update immediately, keep the router off the public internet by restricting access to your local network only, and re-check firewall exposure after any configuration changes.
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.
In plain language
Written by AI from the record
This is a serious remote command-injection flaw in certain TOTOLINK A3002R firmware versions that lets an attacker run commands on the router without logging in; if your business uses this router and it’s reachable from the internet, you should act now.
CVE-2025-25579 is a Command Injection in /bin/boa triggered via the 'bandstr' parameter, allowing unauthenticated remote attackers to execute arbitrary commands on the affected TOTOLINK A3002R device.
If you're affected
Full device takeover
Network disruption
Data theft via compromised router
Ransomware or malware staging risk
What is it
Think of the router like a small office switchboard with its own hidden “commands.” This bug lets a bad actor send specially crafted input so the router starts running those commands, even without a login. If the router is reachable from the internet, the attacker can potentially change how your network behaves—or use the router as a launch point for further harm.
Who is affected
This matters if your small business uses a TOTOLINK A3002R router running V4.0.0-B20230531.1404. Because the flaw is reachable remotely and does not require authentication, any exposure of the relevant router interface to the internet increases risk. This is a risk primarily if the vulnerable service/endpoint is reachable from the internet in your setup (for example, if remote access is enabled or not properly firewalled).
How urgent is it
Treat this as urgent because attackers can remotely inject and execute commands without any login, and public proof-of-concept code exists. Although a definitive KEV listing was not found, the vulnerability is highly capable and remote, which means exposed devices are at immediate risk. This is why this issue is rated AMBER: act quickly to reduce exposure and apply a fix or vendor guidance.
What to do — in detail
Confirm exposure on your specific device
Log into the TOTOLINK A3002R web interface (or check the device label/OS info if available) and note the exact firmware version.
If the firmware is V4.0.0-B20230531.1404, treat the device as affected.
Check whether the device is reachable from the internet
Determine whether your router has any remote-management or WAN-reachable services enabled.
Verify your perimeter firewall/NAT rules: there should be no inbound port forwards to the router’s management/web interface from the public internet.
Upgrade when a vendor fix is available
Search TOTOLINK support for a firmware update addressing the command injection in /bin/boa via 'bandstr' for the A3002R.
Apply the fixed firmware to the router when released.
If the vendor provides multiple branches/versions, choose the newest version that the vendor states is fixed for this CVE.
Temporary workaround if you can’t patch yet
Follow the vendor-style guidance described in the findings: use network controls (firewall restrictions) to limit the ability for remote access.
Practical steps: remove/disable remote administration, remove WAN access, and restrict management to your local network only.
After changes, re-test from a device on the public internet (or using an external testing site) that the router’s management endpoints are not reachable.
What to monitor
After hardening and/or updating, monitor router logs (if available) for repeated requests that resemble malformed parameters.
Watch for unusual router behavior (unexpected reboots, configuration changes, loss of connectivity), which can be signs of compromise when remote command execution is possible.
CISA due date
Not applicable: this issue was not found in the KEV list in the provided findings, so no KEV-specific due date is given here.
Technical context
Severity: Critical (CVSS 9.8 in the provided details), rated AMBER for this prioritization. Weakness: CWE-78 (Command Injection). Mechanism: an attacker can exploit the /bin/boa interface by injecting into the 'bandstr' parameter to execute arbitrary commands on the device. Attack conditions per findings: network-reachable, no authentication required, no user interaction required. Exploitation/availability: public proof-of-concept exists (2 known); KEV was not listed in the provided findings; exploit maturity is therefore at least PoC-level and capable, but no confirmed KEV-driven exploitation is stated in the findings. EPSS: a prediction of likelihood was provided (trend falling), but it is not used to override confirmed exploitation status; since KEV/news do not confirm exploitation here, the urgency is based on remote unauthenticated command execution plus public PoC availability. KEV meaning: the CISA Known Exploited Vulnerabilities catalog was not listed for this CVE in the provided findings, so there is no catalog-backed “known exploited” confirmation in the dataset.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
