CVE-2025-55584 Hardcoded credentials in n/a
Attackers can gain root access to TOTOLINK A3002R routers via insecure telnet credentials, enabling full device control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-55584?
CVE-2025-55584 is a medium-severity vulnerability in Totolink A3002r Firmware, published on 18 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account.
Weakness: CWE-1391
Which versions are affected by CVE-2025-55584?
It affects 1 product.
Products include Totolink A3002r Firmware.
How do I fix CVE-2025-55584?
No fix has been published for CVE-2025-55584 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-55584 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55584 exists.
Other vulnerabilities in Totolink A3002r Firmware
Sources
Also known as GHSA-f629-3q3f-3v3g.