Totolink N300RT EUVD-2026-25975

Requires authenticated administrative access to the Totolink N300RT web management interface with high-privilege credentials (PR:H in CVSS vector). Attacker must successfully authenticate using valid administrator username and password before exploiting the buffer overflow in formIpQoS. Exploitation further requires network reachability to the router's management interface on TCP port 80 or management port. The specific vulnerable firmware version 3.4.0-B20250430 must be installed. Limiting factors that reduce exploitation likelihood include: non-default strong administrative passwords preventing credential-based initial access, network configurations that restrict management interface to internal-only access eliminating remote attack vector (AV:N), and security controls blocking POST requests to /boafrm/formIpQoS. Default credential usage or WAN-exposed management interfaces remove these protective barriers.

Real-world risk is moderate despite the 7.3 CVSS score. The CVSS vector (AV:N/AC:L/PR:H) reveals critical limiting factors: while remotely exploitable over network with low attack complexity, it requires high-privilege authentication (PR:H) meaning the attacker must already possess administrative router credentials. This significantly narrows the attack surface compared to unauthenticated remote code execution. Public exploit code existence (E:P in CVSS 4.0) lowers the barrier for post-authentication attacks. However, EPSS score is not provided to assess real-world exploitation probability. Not listed in CISA KEV, suggesting no confirmed widespread active exploitation. Primary risk scenarios involve credential stuffing against default/weak router passwords, or as a post-compromise escalation technique after initial access via phishing or malware. For organizations with proper router credential management and network segmentation isolating management interfaces, this represents lower priority than unauthenticated remote vulnerabilities. For consumer deployments with default credentials exposed to WAN, risk escalates substantially.

An attacker who has obtained administrative credentials for a Totolink N300RT router (through credential stuffing, phishing, or exploiting default passwords) authenticates to the web management interface remotely. The attacker crafts a malicious HTTP request to /boafrm/formIpQoS with an oversized entry_name parameter containing shellcode, triggering the buffer overflow and overwriting stack memory to hijack execution flow. Successful exploitation grants arbitrary code execution with router firmware privileges, allowing installation of persistent backdoors, traffic interception, DNS hijacking, or pivoting into the internal network. Public proof-of-concept code at https://github.com/xiaohaiyang-ai/IoT-Vulnerability-Research/tree/main/Vendors/TOTOLINK/N300RT/formIpQoS-Bof provides ready-made exploitation capabilities.