CVE-2020-25499: Totolink a3002r Firmware

High severity, CVSS 8.8. EPSS: 4.2% chance of exploitation in the next 30 days.

TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.

Affected products

• Totolink a3002r Firmware: before 1.1.1-b20200824.0128 (fixed in 1.1.1-b20200824.0128)
• Totolink a3002ru-v1 Firmware: before 3.4.0-b20201030.1754 (fixed in 3.4.0-b20201030.1754)
• Totolink a3002ru-v2 Firmware: before 2.1.1-b20200911.1756 (fixed in 2.1.1-b20200911.1756)
• Totolink a702r-v2 Firmware: before 1.0.0-b20201028.1743 (fixed in 1.0.0-b20201028.1743)
• Totolink a702r-v3 Firmware: before 1.0.0-b20201103.1713 (fixed in 1.0.0-b20201103.1713)
• Totolink n100re-v3 Firmware: before 3.4.0-b20201030.0926 (fixed in 3.4.0-b20201030.0926)
• Totolink n150rt Firmware: before 3.4.0-b20201030.1142 (fixed in 3.4.0-b20201030.1142)
• Totolink n200re-v3 Firmware: before 3.4.0-b20201029.1811 (fixed in 3.4.0-b20201029.1811)
• Totolink n200re-v4 Firmware: before 4.0.0-b20200805.1507 (fixed in 4.0.0-b20200805.1507)
• Totolink n210re Firmware: before 1.0.0-b20201030.2030 (fixed in 1.0.0-b20201030.2030)
• Totolink n300rh-v3 Firmware: before 3.2.4-b20201029.1838 (fixed in 3.2.4-b20201029.1838)
• Totolink n300rt Firmware: before 3.4.0-b20201026.2033 (fixed in 3.4.0-b20201026.2033)
• Totolink n302r Plus Firmware: before 3.4.0-b20201028.2224 (fixed in 3.4.0-b20201028.2224)

Published 2020-12-09. Last modified 2026-06-17.