CVE-2025-63468

Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the sub_426EF8 function

High · published October 31, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

⚡ A single crafted request is all it takes to cause a stack overflow in the Totolink LR350! Think of it like a restaurant where too many customers pile into a small dining area — the staff can only handle so much before service grinds to a halt. This vulnerability lets attackers overwhelm the system, causing a Denial of Service that leaves legitimate users out in the cold! If successfully exploited, this vulnerability could lead to a complete service disruption, preventing users from accessing the router. It’s like locking everyone out of their favorite coffee shop during peak hours — absolutely devastating for those reliant on a reliable internet connection!

Put simply

Think of it like a restaurant where too many customers pile into a small dining area — the staff can only handle so much before service grinds to a halt. This vulnerability lets attackers overwhelm the system, causing a Denial of Service that leaves legitimate users out in the cold! The vulnerability occurs in version v9.3.5u.6369_B20220309 of Totolink LR350, specifically in the 'sub_426EF8' function, where a stack overflow can be triggered by manipulating the 'http_host' parameter.

What to do

If successfully exploited, this vulnerability could lead to a complete service disruption, preventing users from accessing the router. It’s like locking everyone out of their favorite coffee shop during peak hours — absolutely devastating for those reliant on a reliable internet connection! To secure your device, update to the latest version available from Totolink immediately. Additionally, consider implementing network monitoring to detect any unusual traffic patterns that may indicate an attack. Staying proactive is key! You've got this! Follow the steps, and you’ll have your network secure in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.4th percentile
Published
2025-10-31T00:00Z
EPSS history
Timeline
  • 31 OCT 00:00Z
    Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the sub_426EF8 function
    cvelistv5