CVE-2025-8937: Totolink N350r Firmware RCE Vulnerability

CVE-2025-8937 Overview

CVE-2025-8937 is a command injection vulnerability affecting TOTOLINK N350R routers running firmware version 1.2.3-B20130826. The flaw resides in the /boafrm/formSysCmd endpoint, where unsanitized user input is passed to an underlying system shell. Authenticated attackers can manipulate request parameters to inject arbitrary operating system commands that execute in the router context. The issue is reachable over the network, and a public disclosure with technical details has been released. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Successful exploitation allows attackers to execute arbitrary shell commands on the TOTOLINK N350R router, leading to device compromise, traffic interception, or use as a pivot into the internal network.

Affected Products

TOTOLINK N350R router (hardware)
TOTOLINK N350R firmware version 1.2.3-B20130826
Deployments exposing the /boafrm/formSysCmd web interface endpoint

Discovery Timeline

2025-08-14 - CVE-2025-8937 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8937

Vulnerability Analysis

The vulnerability exists in the formSysCmd handler within the BOA web server component on the TOTOLINK N350R. The handler accepts parameters from authenticated HTTP requests and concatenates them into a shell command string. Because the inputs are not validated or escaped, shell metacharacters such as ;, |, and backticks pass through to the system call.

An attacker with low-privilege access to the router web interface can submit a crafted POST request to /boafrm/formSysCmd. The injected payload executes with the privileges of the web server process, which typically runs as root on embedded TOTOLINK devices. This grants full control over the router operating system.

The EPSS model places exploitation likelihood in the 82nd percentile, reflecting active interest in TOTOLINK command injection flaws. Public proof-of-concept documentation has been published on GitHub by the reporter.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream shell interpreter [CWE-74]. The formSysCmd function in the BOA HTTP daemon constructs a command line from user-supplied parameters and passes it to system() or an equivalent shell invocation without input filtering, allowlisting, or argument separation.

Attack Vector

Exploitation requires network access to the router management interface and valid low-privilege credentials. The attacker sends an HTTP POST request to /boafrm/formSysCmd containing a command parameter with appended shell metacharacters and arbitrary commands. The BOA daemon parses the parameter, builds a shell string, and executes the injected payload. No user interaction is required after the request is sent. See the GitHub CVE Documentation for the published proof of concept and the VulDB #319900 Analysis for vulnerability metadata.

Detection Methods for CVE-2025-8937

Indicators of Compromise

HTTP POST requests targeting /boafrm/formSysCmd containing shell metacharacters such as ;, &&, |, or backticks in parameter values
Unexpected outbound connections from the router to attacker-controlled infrastructure following web requests
New or modified files in writable router filesystem locations such as /tmp or /var
Unauthorized changes to DNS, DHCP, or routing configuration on the N350R device

Detection Strategies

Inspect web server access logs on perimeter or management network sensors for requests to /boafrm/formSysCmd from unexpected source addresses
Deploy network intrusion detection signatures that match command injection patterns in HTTP request bodies sent to TOTOLINK administrative endpoints
Correlate authentication events on the router with subsequent formSysCmd POST requests to identify abuse of valid credentials

Monitoring Recommendations

Restrict and monitor management plane traffic to consumer and small-office routers through network segmentation
Forward router syslog data to a centralized logging platform for retention and search across HTTP request paths
Alert on outbound connections from router IP addresses to non-standard ports or unknown external hosts

How to Mitigate CVE-2025-8937

Immediate Actions Required

Remove the TOTOLINK N350R management interface from any internet-facing exposure and restrict access to a dedicated management VLAN
Change default and existing administrative credentials to strong, unique values to reduce the likelihood of authenticated abuse
Audit the router for unexpected processes, modified configuration, or unknown user accounts
Plan replacement of the N350R given its age, the dated 2013 firmware build, and the lack of a published vendor patch

Patch Information

No vendor security advisory or patched firmware release has been published by TOTOLINK at the time of NVD publication. Check the TOTOLINK Official Website for any future firmware updates addressing the formSysCmd handler. Given the firmware build date of 2013, the device may be end-of-life and unlikely to receive a fix.

Workarounds

Block external access to the router HTTP administrative interface at the upstream firewall
Disable remote management features on the N350R and require local LAN access for any configuration changes
Replace the affected router with a currently supported model that receives security updates from its vendor

bash

# Example: restrict router management access to a single trusted host on the LAN
# Apply on an upstream firewall in front of the TOTOLINK N350R
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_workstation_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP