Totolink n302r Plus Firmware vulnerabilities

3 CVEs affecting Totolink n302r Plus Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-5672, published 2025-06-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-25499, published 2020-12-09. High severity, CVSS 8.8. EPSS: 4.2% chance of exploitation in the next 30 days. TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
CVE-2025-5672, published 2025-06-05. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK N302R Plus up to 3.4.0-B20201028 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formFilter of…
CVE-2025-5671, published 2025-06-05. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in TOTOLINK N302R Plus up to 3.4.0-B20201028. Affected is an unknown function of the file /boafrm/formPortFw of the component HTTP POST…