PT-2025-48962 · Totolink · Totolink N300Rt

Shiyi Xie + 2 · Published 2025-12-03 · Updated 2025-12-03 · CVE-2025-34319

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK N300RT versions prior to V3.4.0-B20250430

Description The TOTOLINK N300RT wireless router firmware contains an OS command injection issue in the Boa formWsc handling functionality. An unauthenticated attacker can trigger command execution by sending specially crafted requests through the targetAPSsid parameter.

Recommendations Update to version V3.4.0-B20250430 or later.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-15265

CVE-2025-34319

Affected Products

Totolink N300Rt

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-34319 · Security Note
• https://totolink.net/home/menu/detail/menu_listtpl/download/id/154/ids/36.html · Patch
• https://bdu.fstec.ru/vul/2025-15265 · Security Note
• https://twitter.com/VulmonFeeds/status/1996303385822195777 · Twitter Post
• https://t.me/CVEtracker/38760 · Telegram Post
• https://vulncheck.com/advisories/totolink-n300rt-boa-formwsc-rce · Note
• https://totolink.tw/support_view/N300RT · Note
• https://twitter.com/0dayPublishing/status/1996265737048977901 · Twitter Post
• https://twitter.com/CVEnew/status/1996268276209344917 · Twitter Post