BaseFortify

Publication date: 2025-12-15

Last updated on: 2025-12-17

Assigner: MITRE

Description

TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can send payloads to the interface without logging in (remote).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-15

Last Modified

2025-12-17

Generated

2026-07-06

AI Q&A

2025-12-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-55895

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	a3300r_firmware	17.0.0cu.557_b20221024
totolink	a3300r	*
totolink	n200re_firmware	9.3.5u.6437_b20230519
totolink	n200re	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Access Control issue in TOTOLINK A3300R and N200RE devices. It allows attackers to send payloads to the device interface remotely without needing to log in, potentially bypassing authentication mechanisms.

Impact Analysis

The vulnerability can allow unauthorized remote attackers to interact with the device interface without authentication, which may lead to unauthorized access, manipulation of device settings, or other malicious activities that compromise the security and functionality of the affected devices.

Hi! I’m here to help you understand CVE-2025-55895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70