CVE-2025-34319

Critical

Published: 03/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

TOTOLINK N300RT routers with firmware before V3.4.0-B20250430 have an OS command injection vulnerability in the Boa formWsc handling. An unauthenticated attacker can send crafted requests to execute commands via the targetAPSsid parameter.

Risk Assessment

An unauthenticated attacker can take control of the router, potentially leading to network traffic interception or further attacks on the local network.

Recommendation

Update the router firmware to version V3.4.0-B20250430 or later. Restrict access to the administrative panel.

Original NVD description (English source)

TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.