N300rb Firmware CVE-2025-52089

CVSS 3.1 vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates: (1) Attack Vector Adjacent means attacker must be on same network segment—reducing opportunistic internet-scale exploitation but not eliminating risk in corporate/multi-tenant environments; (2) Attack Complexity Low and no privileges required (PR:N, UI:N) indicate trivial exploitation once access is gained; (3) High impact across confidentiality, integrity, and availability reflects root-level command execution. Real-world risk assessment: While CVSS 8.8 is nominally high, the AV:A restriction significantly reduces exploit probability compared to internet-facing vulnerabilities. However, within network-adjacent scenarios (compromised IoT device, insider threat, guest network access), the low AC and lack of privilege requirement make this highly exploitable. Without confirmed KEV status, EPSS data, or public POC availability (as of knowledge cutoff), exploitation likelihood is moderate-to-high among informed attackers but low for automated botnets. This is a priority for organizations where TOTOLINK routers are deployed in shared-access environments (ISPs, corporate networks, educational institutions) but lower priority for isolated home installations. Recommend treating as HIGH priority due to root access implications and firmware version specificity enabling targeted targeting.

An attacker on the same network as a TOTOLINK N300RB running firmware 8.54 (e.g., connected to the same WiFi, shared LAN, or compromised guest network) discovers or is provided the static secret protecting the hidden remote support feature (via reverse engineering, vendor leak, or social engineering). The attacker sends a crafted management request (HTTP POST, telnet, or proprietary protocol) to the device's support interface, authenticates using the static secret, and injects OS commands (e.g., via parameter tampering) that execute as root—enabling full device compromise, credential harvesting from LAN traffic, malware injection, botnet recruitment, or lateral movement attacks into corporate networks. No complex exploitation chain is required; once the secret is known, AC:L and PR:N mean exploitation is point-and-click. Example attack path: compromised IoT device on corporate guest network → discovers TOTOLINK router → uses leaked static secret to gain RCE → exfiltrates WiFi credentials → escalates to main network. POC availability is unconfirmed; if a POC is released post-CVE disclosure, exploit adoption will accelerate rapidly.