TOTOLINK A3300R CVE-2025-55901

Exploitation requires the attacker to reach the device's NTPSyncWithHost management function and supply attacker-controlled data in the host_time parameter on affected firmware A3300R V17.0.0cu.596_B20250515. The primary limiting factor is adjacency: per CVSS AV:A the attacker must be on the same local network segment (connected to the router's LAN or Wi-Fi), so this is not internet-wide remotely exploitable by default and favors on-network or post-foothold attackers. No authentication is indicated (CVSS PR:N) and no user interaction is required (UI:N); no non-default configuration is called out in the description, so default deployments of this specific router model appear affected.

This is a command-injection flaw (CWE-77) in the NTPSyncWithHost function of TOTOLINK A3300R firmware, reachable via the host_time parameter. The supplied CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 6.5) indicates an adjacent-network, low-complexity, unauthenticated attack with high integrity impact but no stated confidentiality or availability impact. That impact profile is internally inconsistent for a command-injection bug: successful OS command execution on an embedded router almost always yields full read, write, and service-control (typically as root), so C:N/A:N likely understates real impact - treat the 6.5 as conservative. Publicly available exploit code exists (a PoC write-up referenced on GitHub), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation - PoC availability and active exploitation are distinct signals. The AV:A (adjacent) rather than AV:N (network) rating means an attacker must be on the same LAN/Wi-Fi segment as the device, which meaningfully limits mass remote exploitation and points toward local/insider or post-foothold scenarios rather than internet-wide scanning. Net: a genuine, PoC-backed unauthenticated code-execution issue on an affected device, but mitigated by adjacency and the absence of KEV/EPSS signals indicating it is currently a widespread priority.

An attacker positioned on the same local network as a TOTOLINK A3300R (e.g., connected to its Wi-Fi or LAN) sends a crafted request to the NTPSyncWithHost function with shell metacharacters embedded in the host_time parameter. Because input is passed unsanitized into an OS command, the injected commands execute on the router, typically with elevated/root privileges. Public PoC material is referenced (GitHub write-up for CVE-2025-55901), lowering the skill barrier; CVSS AC:L/PR:N means no special timing or authentication is required once the attacker has adjacent access.