VULNERABILITY INTELLIGENCE
CVE-2025-34319
CVSS score9.3 CRITICAL
EPSS probability4.36%
CISA KEVNot currently listed
Published2025-12-03
Last modified2026-10-18
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.
Weakness classification
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')