CVE-2025-34319
CriticalSummary
TOTOLINK N300RT routers with firmware before V3.4.0-B20250430 have an OS command injection vulnerability in the Boa formWsc handling. An unauthenticated attacker can send crafted requests to execute commands via the targetAPSsid parameter.
Risk Assessment
An unauthenticated attacker can take control of the router, potentially leading to network traffic interception or further attacks on the local network.
Recommendation
Update the router firmware to version V3.4.0-B20250430 or later. Restrict access to the administrative panel.
Other vulnerabilities in TOTOLINK N300RT
See all- CVE-2026-7219High
A buffer overflow vulnerability has been found in Totolink N300RT 3.4.0-B20250430 in an unknown function of the file /boafrm/formIpQoS. Manipulating the argument entry_name can lead to buffer overflow, and the attack can be performed remotely. The exploit has been published and may be used.
- CVE-2026-7218High
A buffer overflow vulnerability was detected in the Totolink N300RT router version 3.4.0-B20250430 in the is_cmd_string_valid function in /boafrm/formWsc of the libapmib.so component. Manipulating the localPin argument causes a buffer overflow. The attack can be carried out remotely, and the exploit is publicly available.
Original NVD description (English source)
TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.