TOTOLINK N200RE CVE-2025-55893

Exploitation requires sending a request to the router's setOpModeCfg operation-mode configuration endpoint with an attacker-controlled hostName value containing shell metacharacters; no authentication or user interaction is needed (PR:N/UI:N). The key limiting factor is the adjacent attack vector (AV:A): the attacker must be on the same local network/broadcast domain (e.g., connected to the device's Wi-Fi or wired LAN), not a remote internet host, so the flaw is not directly exploitable from the WAN in a default configuration. It applies specifically to TOTOLINK N200RE firmware V9.3.5u.6437_B20230519.

This is a CWE-77 command injection in the TOTOLINK N200RE router's setOpModeCfg handler via the hostName parameter, carrying a CVSS 3.1 base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The signals are moderately consistent but incomplete: the CVSS vector indicates an adjacent-network, low-complexity, unauthenticated attack, and publicly available exploit code exists (a PoC PDF hosted on GitHub), which raises practical risk above a theoretical rating. However, there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation - the presence of a PoC indicates feasibility, not observed in-the-wild use. One notable tension: the NVD vector scores impact as C:N/I:H/A:N, yet command injection on an embedded router typically yields arbitrary OS command execution (usually as root), which would normally imply full confidentiality, integrity AND availability loss - the provided vector appears to understate real impact, so the true severity is likely higher than 6.5. No SSVC decision data was supplied. Net: a credible, PoC-backed flaw that is a real priority for anyone running this specific device on a shared LAN/WiFi segment, but the adjacent-only attack vector (not internet-routable by default) and niche consumer footprint cap its broad urgency.

An attacker already on the same local network segment as the router (e.g., connected to its Wi-Fi or LAN) sends a crafted request to the setOpModeCfg endpoint with a malicious payload in the hostName field, which is passed unsanitized to a shell command. Because the CVSS vector is AV:A/AC:L/PR:N, no authentication or user interaction is required and exploitation is low-complexity. A public proof-of-concept exists (GitHub-hosted PDF), making reproduction straightforward for an adjacent attacker.