CVE-2025-34319

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-34319", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-04-15T19:15:22.585Z", "datePublished": "2025-12-03T16:49:11.306Z", "dateUpdated": "2026-05-14T02:08:12.502Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Boa formWsc handling functionality", "targetAPSsid request parameter"], "product": "N300RT", "vendor": "TOTOLINK", "versions": [{"lessThan": "V3.4.0-B20250430", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "V3.4.0-B20250430"}]}]}], "credits": [{"lang": "en", "type": "finder", "value": "YuChieh Kuo"}, {"lang": "en", "type": "finder", "value": "ShiYi Xie"}, {"lang": "en", "type": "finder", "value": "Zhen-Gao Liu"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "TOTOLINK N300RT wireless router firmware versions prior to&nbsp;V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter."}], "value": "TOTOLINK N300RT wireless router firmware versions prior to\u00a0V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-14T02:08:12.502Z"}, "references": [{"tags": ["patch"], "url": "https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/154/ids/36.html"}, {"tags": ["product"], "url": "https://totolink.tw/support_view/N300RT"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/totolink-n300rt-boa-formwsc-rce"}], "source": {"discovery": "UNKNOWN"}, "title": "TOTOLINK N300RT <= V2.1.8-B20201030.1539 Boa formWsc RCE", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T21:26:50.546941Z", "id": "CVE-2025-34319", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T21:27:04.052Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-34319", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-03T21:26:50.546941Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T21:26:59.744Z"}}], "cna": {"title": "TOTOLINK N300RT <= V2.1.8-B20201030.1539 Boa formWsc RCE", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "YuChieh Kuo"}, {"lang": "en", "type": "finder", "value": "ShiYi Xie"}, {"lang": "en", "type": "finder", "value": "Zhen-Gao Liu"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TOTOLINK", "modules": ["Boa formWsc handling functionality", "targetAPSsid request parameter"], "product": "N300RT", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.4.0-B20250430", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/154/ids/36.html", "tags": ["patch"]}, {"url": "https://totolink.tw/support_view/N300RT", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/totolink-n300rt-boa-formwsc-rce", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "TOTOLINK N300RT wireless router firmware versions prior to\u00a0V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.", "supportingMedia": [{"type": "text/html", "value": "TOTOLINK N300RT wireless router firmware versions prior to&nbsp;V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "V3.4.0-B20250430"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-14T02:08:12.502Z"}}}, "cveMetadata": {"cveId": "CVE-2025-34319", "state": "PUBLISHED", "dateUpdated": "2026-05-14T02:08:12.502Z", "dateReserved": "2025-04-15T19:15:22.585Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-12-03T16:49:11.306Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Boa formWsc handling functionality", "targetAPSsid request parameter"], "product": "N300RT", "vendor": "TOTOLINK", "versions": [{"lessThan": "V3.4.0-B20250430", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TOTOLINK N300RT wireless router firmware versions prior to\u00a0V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter."}, {"lang": "es", "value": "Versiones de firmware del router inal\u00e1mbrico TOTOLINK N300RT anteriores a V3.4.0-B20250430 (descubierta en V2.1.8-B20201030.1539) contienen una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en la funcionalidad de manejo Boa formWsc. Un atacante no autenticado puede enviar solicitudes especialmente dise\u00f1adas para desencadenar la ejecuci\u00f3n de comandos a trav\u00e9s del par\u00e1metro de solicitud targetAPSsid."}], "id": "CVE-2025-34319", "lastModified": "2026-10-18T17:10:00.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34319", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-03T21:26:50.546941Z", "version": "2.0.3"}}]}, "published": "2025-12-03T17:15:51.840", "references": [{"source": "disclosure@vulncheck.com", "url": "https://totolink.tw/support_view/N300RT"}, {"source": "disclosure@vulncheck.com", "url": "https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/154/ids/36.html"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/totolink-n300rt-boa-formwsc-rce"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"created": "2025-12-04T16:44:21.729546+00:00", "updated": "2025-12-04T16:44:21.729572+00:00", "vendors": ["totolink", "totolink$PRODUCT$n300rt"]}