Totolink a702r Firmware vulnerabilities

32 CVEs affecting Totolink a702r Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-9783, published 2025-09-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-19825, published 2020-01-27. Critical severity, CVSS 9.8. EPSS: 29.6% chance of exploitation in the next 30 days. On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the…
CVE-2019-19824, published 2020-01-27. High severity, CVSS 8.8. EPSS: 25.1% chance of exploitation in the next 30 days. On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not…
CVE-2025-8140, published 2025-07-25. High severity, CVSS 8.8. EPSS: 9.6% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formWlanMultipleAP of the component…
CVE-2025-8138, published 2025-07-25. High severity, CVSS 8.8. EPSS: 9.6% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formOneKeyAccessButton of the…
CVE-2019-19822, published 2020-01-27. High severity, CVSS 7.5. EPSS: 8.7% chance of exploitation in the next 30 days. A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and…
CVE-2019-19823, published 2020-01-27. High severity, CVSS 7.5. EPSS: 6.4% chance of exploitation in the next 30 days. A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK…
CVE-2025-6627, published 2025-06-25. High severity, CVSS 8.8. EPSS: 5.7% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formIpv6Setup of the component HTTP POST…
CVE-2025-8136, published 2025-07-25. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in TOTOLINK A702R 4.0.0-B20230721.1521. Affected is an unknown function of the file /boafrm/formFilter of the component HTTP POST Request…
CVE-2025-8139, published 2025-07-25. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been classified as critical. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request…
CVE-2025-8137, published 2025-07-25. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formIpQoS of the…

Latest

CVE-2025-9783, published 2025-09-01. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was determined in TOTOLINK A702R 4.0.0-B20211108.1423. This issue affects the function sub_418030 of the file /boafrm/formParentControl. Executing manipulation of the argument…
CVE-2025-9782, published 2025-09-01. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK A702R 4.0.0-B20211108.1423. This vulnerability affects the function sub_4466F8 of the file /boafrm/formOneKeyAccessButton. Performing manipulation of the…
CVE-2025-9781, published 2025-09-01. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK A702R 4.0.0-B20211108.1423. This affects the function sub_4162DC of the file /boafrm/formFilter. Such manipulation of the argument ip6addr leads to buffer…
CVE-2025-9780, published 2025-09-01. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw has been found in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this issue is the function sub_419BE0 of the file /boafrm/formIpQoS. This manipulation of the argument mac causes buffer…
CVE-2025-9779, published 2025-09-01. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was detected in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this vulnerability is the function sub_4162DC of the file /boafrm/formFilter. The manipulation of the argument ip6addr…