External risk intelligence

TOTOLINK N300RT OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-34319

The vulnerability exists in a wireless router, which is an internet-edge device by design. The flaw is reachable via unauthenticated network requests to the router's web management interface, a component typically accessible or exposed in standard deployment scenarios.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability identified in TOTOLINK wireless router firmware. The issue allows unauthenticated attackers to execute commands on the affected devices by sending specially crafted requests, potentially impacting network security and stability. The main concern is confirming relevance and exposure.

Unauthenticated commands can be run on routers.
Routers are critical network access points.
Confirm device exposure and assess potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a wireless router's web management interface. This request would target the Boa formWsc handling functionality, specifically through the `targetAPSsid` parameter. If successful, this could lead to the execution of arbitrary commands on the router.

No authentication required for access.
Triggered by specially crafted network requests.
Enables arbitrary command execution on the device.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the affected device when they send specially crafted requests to the Boa web server's `formWsc` functionality. This could impact the device's service behavior and potentially expose system data.

Router system commands could be executed.
Specially crafted requests to web interface.
Device compromise and potential disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

For this critical OS command injection vulnerability in TOTOLINK N300RT wireless routers, ownership likely falls to the teams managing network infrastructure and connected devices, potentially including a vendor management team if the devices were procured through a third party. The first practical step is to identify all instances of this router model within the environment, confirm their internet reachability or business criticality, and then locate the accountable owner to plan remediation.

Network and infrastructure teams own remediation.
Verify all affected device locations and exposure.
Plan coordinated firmware updates or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK N300RT?

The TOTOLINK N300RT is a wireless router designed to provide network connectivity for homes and small offices. It functions as a gateway, managing traffic between local devices and the internet. Like many similar networking products, it includes embedded firmware with a web-based management interface that allows users to configure settings such as Wi-Fi passwords and network security.

What does OS command injection mean for CVE-2025-34319?

This vulnerability, classified as CWE-78, occurs when software fails to properly sanitize user input before passing it to a system shell. In this case, the router's management software incorrectly processes information. This flaw allows an attacker to inject their own commands, which the device then executes with the privileges of the system, potentially granting the attacker control over the router's internal functions.

How is the vulnerability triggered in this device?

An attacker triggers this by sending a specially crafted network request to the Boa web server component running on the router. Specifically, the malicious input is delivered through the 'targetAPSsid' parameter within the 'formWsc' function. Simply navigating to the router's web interface without submitting this specific, manipulated parameter will not trigger the command execution.

Why is this router vulnerability relevant to me?

According to Halo Surface Signal, this issue is significant because it affects a wireless router, which is an internet-edge device. Because the flaw can be reached via unauthenticated network requests to the web management interface, any device exposed to the internet is at higher risk. You should care if your routers are configured to allow access from outside your local network.

What should I do if I use these routers?

Your first step is to create an inventory of all TOTOLINK N300RT units in your environment. Confirm whether these devices are reachable from the internet or if they serve critical business functions. Once you have identified them, work with the team responsible for your network infrastructure to verify your firmware version and plan for the necessary updates to secure the hardware.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.