CVE-2025-34319: Totolink n300rt

Critical severity, CVSS 9.3. EPSS: 4.4% chance of exploitation in the next 30 days.

TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.

Affected products

• Totolink n300rt: before V3.4.0-B20250430 (fixed in V3.4.0-B20250430)

Published 2025-12-03. Last modified 2026-06-17.