CVE-2025-63465: Totolink LR350 Firmware DoS Vulnerability

CVE-2025-63465 Overview

CVE-2025-63465 is a stack-based buffer overflow [CWE-121] in the Totolink LR350 router firmware version 9.3.5u.6369_B20220309. The vulnerability resides in the sub_422880 function, which processes the ssid parameter without proper bounds checking. Remote attackers can send a crafted HTTP request containing an oversized ssid value to overflow the stack buffer. Successful exploitation causes the affected device to crash, resulting in a Denial of Service (DoS) condition. The flaw is reachable over the network without authentication or user interaction.

Critical Impact

Unauthenticated remote attackers can trigger a stack overflow in the Totolink LR350 router, forcing the device into a Denial of Service state and disrupting network connectivity for all downstream clients.

Affected Products

• Totolink LR350 router (hardware)
• Totolink LR350 firmware version 9.3.5u.6369_B20220309
• Deployments exposing the affected web management interface to untrusted networks

Discovery Timeline

• 2025-10-31 - CVE-2025-63465 published to the National Vulnerability Database (NVD)
• 2025-11-05 - Last updated in NVD database

Technical Details for CVE-2025-63465

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow [CWE-121] located inside the sub_422880 function of the Totolink LR350 firmware. The function handles the ssid parameter supplied through a request to the device, but does not validate the length of the input before copying it into a fixed-size stack buffer. When an attacker submits an ssid value exceeding the buffer size, adjacent stack data — including saved registers and the return address — is overwritten. On the MIPS-based LR350 platform this results in process termination and a forced reboot or service hang, breaking router functionality until manual recovery.

Root Cause

The root cause is missing length validation on attacker-controlled input. The sub_422880 routine uses an unchecked copy operation to move the ssid string into a stack-allocated buffer. No upper bound is enforced and no canary or stack protection mitigates the overwrite, so any oversized value corrupts the call frame.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the vulnerable handler by submitting a crafted request to the router's web interface with a ssid parameter containing a long string payload. Because the LR350 exposes its management endpoints on the LAN by default — and in some deployments on the WAN — any host with network reachability to the device can trigger the crash. The current CVSS scoring reflects an availability-only impact, with no confirmed pathway to code execution at this time.

No public exploit code is available. Technical analysis is documented in the GitHub Vulnerability Analysis referenced by the advisory.

Detection Methods for CVE-2025-63465

Indicators of Compromise

• Unexpected reboots or watchdog-triggered restarts of the Totolink LR350 router
• HTTP requests to the router's management interface containing abnormally long ssid parameter values
• Loss of LAN/WAN connectivity correlating with inbound requests from unknown source addresses

Detection Strategies

• Inspect HTTP request bodies and query strings directed at the router for ssid parameters exceeding expected length thresholds (for example, longer than 32 bytes per IEEE 802.11 SSID limits).
• Correlate router crash events and uptime resets with network telemetry to identify request-induced failures.
• Apply network intrusion detection signatures that flag oversized form parameters targeting embedded device administration endpoints.

Monitoring Recommendations

• Log all access attempts to the LR350 web administration interface and alert on requests from non-administrative source addresses.
• Monitor SNMP or syslog output from the router for repeated process crashes or reboot loops.
• Track availability of the router from upstream monitoring tools to detect DoS conditions in near real time.

How to Mitigate CVE-2025-63465

Immediate Actions Required

• Restrict access to the LR350 web management interface to trusted management VLANs only and block exposure to the internet.
• Disable remote (WAN-side) administration on the router until a vendor patch is available.
• Place the router behind a network filter that drops HTTP requests with oversized ssid parameters.

Patch Information

As of the last NVD update on 2025-11-05, no vendor advisory or firmware update from Totolink addressing CVE-2025-63465 has been published. Administrators should monitor the Totolink support portal for a successor firmware release beyond 9.3.5u.6369_B20220309 and apply it once available.

Workarounds

• Limit management interface reachability to a dedicated administrative subnet using firewall ACLs.
• Enforce strong, unique administrative credentials and disable any unused services on the device to reduce attack surface.
• Where feasible, replace end-of-support consumer routers with hardware that receives active security maintenance.

# Example: restrict access to the LR350 management interface using iptables on an upstream gateway
# Allow only the management workstation 192.0.2.10 to reach the router at 192.168.1.1
iptables -A FORWARD -s 192.0.2.10 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 443 -j DROP