What is the CVSS score of CVE-2025-34319?

CVE-2025-34319 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 3.4%.

Which versions of TOTOLINK are affected by CVE-2025-34319?

A critical unauthenticated remote code execution vulnerability affecting TOTOLIK N300RT wireless routers (firmware versions prior to V3.4.0-B20250430) allows attackers to execute arbitrary commands…

How to fix or mitigate CVE-2025-34319?

Within 24 hours: Identify all TOTOLINK N300RT routers in your environment and their firmware versions; isolate affected devices from critical network segments if possible. Within 7 days: Implement network-based mitigations including WAF rules blocking malicious targetAPSsid parameters and disabling remote management access; contact TOTOLINK for patch availability status. Within 30 days: Deploy replacement routers from alternate vendors or apply vendor patch immediately upon release; conduct network forensics for signs of compromise.

TOTOLINK CVE-2025-34319

EUVD-2025-201000 CRITICAL

OS Command Injection (CWE-78)

2025-12-03 disclosure@vulncheck.com

Command Injection TOTOLINK

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:14 euvd

EUVD-2025-201000

Analysis Generated

Mar 15, 2026 - 16:14 vuln.today

CVE Published

Dec 03, 2025 - 17:15 nvd

CRITICAL 9.3

DescriptionCVE.org

TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.

Analysis

Technical ContextAI

Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells. This vulnerability is classified as OS Command Injection (CWE-78).

RemediationAI

Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.