PT-2025-48962 · Totolink · Totolink N300Rt

Shiyi Xie + 2 · Publicado 2025-12-03 · Atualizado 2025-12-03 · CVE-2025-34319

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK N300RT versions prior to V3.4.0-B20250430

Description The TOTOLINK N300RT wireless router firmware contains an OS command injection issue in the Boa formWsc handling functionality. An unauthenticated attacker can trigger command execution by sending specially crafted requests through the targetAPSsid parameter.

Recommendations Update to version V3.4.0-B20250430 or later.

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2025-15265

CVE-2025-34319

Produtos afetados

Totolink N300Rt

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-34319 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1996303385822195777 · Publicação no Twitter
• https://t.me/CVEtracker/38760 · Publicação no Telegram
• https://vulncheck.com/advisories/totolink-n300rt-boa-formwsc-rce · Nota
• https://totolink.tw/support_view/N300RT · Nota
• https://totolink.net/home/menu/detail/menu_listtpl/download/id/154/ids/36.html · Correção
• https://twitter.com/0dayPublishing/status/1996265737048977901 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2025-15265 · Nota de Segurança
• https://twitter.com/CVEnew/status/1996268276209344917 · Publicação no Twitter