N300rh Firmware EUVD-2025-18805

The CVSS 3.1 score of 8.8 reflects high severity, driven by high impact scores across confidentiality (C:H), integrity (I:H), and availability (A:H). The attack vector is network-based (AV:N) with low attack complexity (AC:L), meaning no special conditions are required. However, the attack requires low privilege (PR:L), indicating authentication is mandatory—this moderately reduces real-world impact compared to unauthenticated vulnerabilities. The presence of publicly disclosed exploit code significantly increases exploitation probability and real-world risk. The lack of user interaction (UI:N) and scoped impact (S:U) further increase severity. Without specific EPSS or KEV confirmation data provided, the disclosed POC availability and network accessibility of home routers suggest elevated exploitation likelihood in the wild. This is a genuine priority: authenticated attackers (potentially via credential stuffing, social engineering, or insider threats) can remotely achieve complete system compromise. Home and small office routers are commonly exposed to untrusted networks and may be accessed by guests or compromised user accounts.

An attacker with valid credentials to the router's web management interface (obtained via phishing, weak password, or insider access) sends a specially crafted HTTP POST request to http://<router-ip>/boafrm/formPortFw with an oversized or malicious value in the service_type parameter. The HTTP POST handler processes this input without bounds checking, causing a buffer overflow that overwrites adjacent stack or heap memory. Depending on memory layout and overflow size, the attacker can overwrite return addresses or function pointers to redirect execution to injected shellcode, gaining remote code execution as the web server process (often running as root on embedded devices). This allows the attacker to modify firewall rules, exfiltrate network traffic, install backdoors, or render the device non-functional. Given the disclosed POC, automated tools may rapidly scan for vulnerable N300RH instances on the public internet and exploit them once credentials are obtained through auxiliary means.