TOTOLINK LR350
CVE-2025-63465
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach LR350 management interface over network
-
ExploitSend request with oversized ssid parameter
-
ExecutionOverflow stack buffer in sub_422880
-
ImpactCrash device causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires sending a crafted request containing an overlong 'ssid' parameter that reaches the sub_422880 function in the LR350 firmware v9.3.5u.6369_B20220309, triggering a stack overflow (CWE-121). Only this specific firmware build is identified as affected. Limiting factors: the impact is confined to Denial of Service (no code execution stated), and the attacker must be able to reach the management interface that handles the ssid parameter. The CVSS vector asserts no authentication (PR:N), but the available sources do not explicitly state whether this endpoint is reachable without authentication - this limiting factor should be verified before assuming fully unauthenticated reach. |
| Impact | Signals are consistent but point to a moderate, not urgent, issue. The CVSS 3.1 base score is 7.5 driven entirely by availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - the only impact is a Denial of Service, with no confidentiality or integrity loss, which is consistent with CWE-121 (stack-based buffer overflow) used to crash the device rather than achieve code execution. EPSS is low at 0.41% (35th percentile), and this CVE is NOT in CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists but is not verified as working exploit code, so POC availability must not be treated as active exploitation. The vendor-priority Decision label is 'this_week', which aligns with a real-but-non-emergency item. Net: this is a legitimate network-reachable DoS against a specific consumer-router firmware build, not a high-CVSS-but-illusory issue, yet the capped impact (crash only), low EPSS, and absence of KEV keep it well below top priority. One caveat to verify: the CVSS vector asserts PR:N (unauthenticated), but the description does not state whether the ssid-setting endpoint is reachable pre-authentication on the LR350 web interface - this should be confirmed with the vendor or by testing, as it materially changes real-world reach. |
| Exploit ScenarioDerived | An attacker with network access to the TOTOLINK LR350 management interface sends a crafted request supplying an overlong 'ssid' parameter that is processed by the sub_422880 function, overflowing a stack buffer and crashing the device. The result is a Denial of Service (router reboot/hang) rather than code execution. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Stack-based buffer overflow in TOTOLINK LR350 firmware 9.3.5u.6369_B20220309 allows a crafted request containing an overlong ssid parameter handled by sub_422880 to crash the device and cause denial of service. Only that firmware build is identified as affected, and the impact is availability-only (CVSS 3.1 7.5, C:N/I:N/A:H). A public PoC reference exists but is not verified as working exploit code; EPSS is 0.41% (35th percentile), no CISA KEV entry is reported, and the sources do not confirm whether the relevant endpoint is reachable without authentication despite the PR:N vector.
RemediationAI
No vendor-released patch or fixed version is identified in the supplied data for TOTOLINK LR350 firmware 9.3.5u.6369_B20220309, so a version-specific upgrade cannot be cited. Because exploitation requires sending a crafted ssid value that reaches sub_422880, reduce exposure by restricting access to the interface that handles the ssid parameter to trusted networks, disabling remote management where it is not required, and isolating the device from untrusted networks; these are compensating controls whose effectiveness is not validated by the supplied sources. Monitor the VulDB advisory (https://vuldb.com/vuln/330847) and the GitHub reference (https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/LR350/2/1.md) for updated fix information, and replace or isolate the device if the management interface cannot be adequately restricted.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-121 stack-based buffer overflow in the LR350 firmware build identified by CPE cpe:2.3:o:totolink:lr350_firmware:9.3.5u.6369_b20220309:*:*:*:*:*:*:*. According to the description, an overlong value in the ssid parameter reaches the sub_422880 function, overflowing a stack buffer; the supplied sources do not describe the exact parsing path, memory layout, or whether the endpoint is a web/management interface, so those mechanics are not confirmed. The CVSS vector indicates network reachability with low attack complexity and no privileges or user interaction required, but the authentication reachability of the ssid-handling path is not explicitly established. The assessed impact is denial of service through device crash; no code execution, information disclosure, or integrity impact is stated.
Know when Lr350 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable crafted request with no stated user interaction yields a DoS only, so C:N/I:N/A:H; PR:N retained per the input, though the endpoint's auth requirement is not described in sources.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_422880 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Executive ViewAI
A high-severity denial-of-service vulnerability in TOTOLINK LR350 router firmware (version 9.3.5u.6369_B20220309) allows an attacker to crash affected devices by sending a specially crafted request with an overly long SSID parameter. Organizations relying on these routers for network connectivity or remote access could experience service outages, disrupting operations and potentially impacting business continuity. Leadership should prioritize identifying and mitigating exposed devices to prevent avoidable downtime.
No vendor-released patch identified at time of analysis. Interim mitigations include isolating affected devices on separate network segments, restricting management access to trusted IPs, disabling remote administration, and monitoring for abnormal device restarts. Consider replacing devices if no patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Lr350 Firmware
View allIncorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration fil
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName param
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName param
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname param
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post d
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function. Rat
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg func
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFil
Buffer overflow in Totolik LR350 firmware allows authenticated remote attackers to achieve full system compromise throug
Stack-based buffer overflow in Totolink LR350 firmware (version 9.3.5u.6369_B20220309) allows authenticated remote attac
Exploit-DB