CVE-2025-34319CWE-78command-injection

CVE-2025-34319

published December 3, 2025

CVSS
9.3
EPSS
4%
Percentile
91.2
In the wild
Unconfirmed
What it is

TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.04364 · 91.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-03T22:15Z
References (3)
https://totolink.tw/support_view/N300RT · [email protected]https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/154/ids/36.html · [email protected]https://www.vulncheck.com/advisories/totolink-n300rt-boa-formwsc-rce · [email protected]
EPSS history
Timeline
  • 03 DEC 16:49Z
    TOTOLINK N300RT <= V2.1.8-B20201030.1539 Boa formWsc RCE
    cvelistv5