by Kastro
Paper/Archive/CVE-2025-34319

CVE-2025-34319

TOTOLINK N300RT — TOTOLINK N300RT <= V2.1.8-B20201030.1539 Boa formWsc RCE

EPSS 4%CVSS 9.3
critical.is priorityof 100
46
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 91.3.913 × 2018.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.

Affected

ProductAffectedFixed inSource
N300RT< V3.4.0-B20250430V3.4.0-B20250430CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchtotolink.net/home/menu/detail/menu_listtpl/download/id/154/ids/36.htmlreftotolink.tw/support_view/N300RTwriteupvulncheck.com/advisories/totolink-n300rt-boa-formwsc-rce