{"id":"CVE-2025-6401","state":"PUBLISHED","title":"TOTOLINK N300RH HTTP POST Message formFilter denial of service","description":"A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been classified as problematic. This affects an unknown part of the file /boafrm/formFilter of the component HTTP POST Message Handler. The manipulation of the argument url leads to denial of service. The exploit has been disclosed to the public and may be used.","publishedAt":"2025-06-21T06:31:08.227Z","updatedAt":"2025-06-23T19:27:48.226Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["TOTOLINK N300RH"],"affected":[{"vendor":"TOTOLINK","product":"N300RH","versions":[{"version":"6.1c.1390_B20191101","status":"affected"}],"modules":["HTTP POST Message Handler"]}],"references":["https://vuldb.com/?id.313395","https://vuldb.com/?ctiid.313395","https://vuldb.com/?submit.597688","https://github.com/d2pq/cve/blob/main/616/21.md","https://github.com/d2pq/cve/blob/main/616/21.md#poc","https://www.totolink.net/"],"weaknesses":["CWE-404"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/6xxx/CVE-2025-6401.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-6401","state":"PUBLISHED","datePublished":"2025-06-21T06:31:08.227Z","dateUpdated":"2025-06-23T19:27:48.226Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-06-20T10:38:48.055Z"},"containers":{"cna":{"title":"TOTOLINK N300RH HTTP POST Message formFilter denial of service","descriptions":[{"lang":"en","value":"A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been classified as problematic. This affects an unknown part of the file /boafrm/formFilter of the component HTTP POST Message Handler. The manipulation of the argument url leads to denial of service. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Es wurde eine Schwachstelle in TOTOLINK N300RH 6.1c.1390_B20191101 ausgemacht. Sie wurde als problematisch eingestuft. Es betrifft eine unbekannte Funktion der Datei /boafrm/formFilter der Komponente HTTP POST Message Handler. Mittels dem Manipulieren des Arguments url mit unbekannten Daten kann eine denial of service-Schwachstelle ausgenutzt werden. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"TOTOLINK","product":"N300RH","versions":[{"version":"6.1c.1390_B20191101","status":"affected"}],"modules":["HTTP POST Message Handler"]}],"references":[{"url":"https://vuldb.com/?id.313395","name":"VDB-313395 | TOTOLINK N300RH HTTP POST Message formFilter denial of service","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.313395","name":"VDB-313395 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.597688","name":"Submit #597688 | TOTOLINK  N300RH_V4 V6.1c.1390_B20191101 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/d2pq/cve/blob/main/616/21.md","tags":["related"]},{"url":"https://github.com/d2pq/cve/blob/main/616/21.md#poc","tags":["exploit"]},{"url":"https://www.totolink.net/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"vectorString":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":2.3,"vectorString":"AV:A/AC:M/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-404","type":"CWE","lang":"en","description":"Denial of Service"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-06-21T06:31:08.227Z"},"timeline":[{"time":"2025-06-20T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-06-20T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-06-20T12:43:55.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"yuhongxiang (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/d2pq/cve/blob/main/616/21.md","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-23T16:09:27.308682Z","id":"CVE-2025-6401","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-23T19:27:48.226Z"}}]}}}