CVE-2025-34319

TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.

CVSS 4.0

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS

4.4% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-25)

CWE

CWE-78

Published

2025-12-03

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

References

• https://totolink.tw/support_view/N300RT
• https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/154/ids/36.html
• https://www.vulncheck.com/advisories/totolink-n300rt-boa-formwsc-rce

Check your stackJSON