Vulnerability · Published Dec 3, 2025 · Assigned by VulnCheck

CVE-2025-34319TOTOLINK N300RT <= V2.1.8-B20201030.1539 Boa formWsc RCE

Critical 9.3

In plain English

A critical-severity OS command injection in N300RT from TOTOLINK. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.3% (higher than 91% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)4.3%top 8.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.

Affected products (as reported)

Vendor	Product	Versions
TOTOLINK	N300RT	0 – before V3.4.0-B20250430

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/154/ids/36.html patch
https://totolink.tw/support_view/N300RT product
https://www.vulncheck.com/advisories/totolink-n300rt-boa-formwsc-rce third-party-advisory