Critical severity · published Dec 3, 2025
CVE-2025-34319
TOTOLINK N300RT <= V2.1.8-B20201030.1539 Boa formWsc RCE
9.3
CVSS
4.4%
EPSS
No
On KEV
Description
TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
N3
N300RT · TOTOLINK
before V3.4.0-B20250430 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34319
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34319
totolink.tw
https://totolink.tw/support_view/N300RT
www.totolink.net
https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/154/ids/36.html
www.vulncheck.com
https://www.vulncheck.com/advisories/totolink-n300rt-boa-formwsc-rce
More from N300RT
6.5
CVE-2024-32334
TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firewall Page
5.5
CVE-2024-32327
TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in Port Forwarding under the Firewall Page
4.3
CVE-2024-32333
TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page