TOTOLINK LR350 CVE-2025-63464

Exploitation requires reaching the handler sub_42396C and supplying a crafted overlong value in the 'ssid' parameter on TOTOLINK LR350 firmware 9.3.5u.6369_B20220309. A key limiting factor is access to the endpoint that processes the SSID setting: SSID configuration on this router is normally part of the authenticated web administration interface, so despite the NVD PR:N rating, realistic exploitation likely requires access to (or a session on) the admin panel, or network adjacency to it - the available sources do not confirm the endpoint is exposed pre-authentication. Impact is limited to availability (device/service crash); the evidence shows no confidentiality or integrity effect and no code execution. Exploitation is further bounded to this specific firmware build on this single device model.

Signals are mixed and point to a moderate, non-urgent issue rather than a top priority. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H only, C:N/I:N) yields 7.5 and describes an unauthenticated network-reachable availability-only impact - consistent with the description's Denial of Service outcome and no code-execution claim. However, the PR:N rating is questionable: the affected input is the 'ssid' parameter handled in sub_42396C, which on this class of router is a Wi-Fi configuration setting normally reached through the authenticated administrative web interface, so network-unauthenticated reach against a default configuration is not clearly established by the evidence - verify whether sub_42396C is exposed pre-authentication. Corroborating low-urgency signals: EPSS is 0.41% (35th percentile), there is NO CISA KEV listing, and the only exploit artifact is a GitHub reference that is not verified as working exploit code. The vuln.today decision label is 'this_week' (not act_now/emergency). Net: a genuine availability bug worth patching on a normal cycle, not an actively-exploited emergency; the headline 7.5 overstates real-world risk given the DoS-only impact, low EPSS, absence of KEV, and uncertainty over whether exploitation truly requires no authentication.

An attacker able to reach the router's web management service sends a crafted request supplying an overlong 'ssid' value that overflows a stack buffer in sub_42396C, crashing the affected process or the device and denying service to legitimate users. A public PoC reference exists but is not verified as working exploit code, so reliability is unproven. Low attack complexity (AC:L) means no special timing or grooming is required once the vulnerable endpoint is reachable.