CVE-2025-8938: Totolink N350r Firmware RCE Vulnerability

CVE-2025-8938 is a remote code execution vulnerability in Totolink N350r Firmware affecting the Telnet Service component. Attackers can exploit this backdoor flaw remotely to gain unauthorized access and execute malicious code. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-8938 Overview

CVE-2025-8938 is a backdoor vulnerability in the TOTOLINK N350R router running firmware version 1.2.3-B20130826. The flaw resides in the formSysTel function of the /boafrm/formSysTel endpoint, which handles the Telnet Service configuration. Manipulation of the TelEnabled argument allows an authenticated remote attacker to enable a hidden Telnet backdoor on the device. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse against exposed devices. This weakness is categorized as [CWE-912] Hidden Functionality.

Critical Impact
Remote attackers with low-level credentials can activate the Telnet service on affected TOTOLINK N350R routers, establishing a persistent backdoor channel for further compromise.

Affected Products

TOTOLINK N350R router (hardware)
TOTOLINK N350R firmware version 1.2.3-B20130826
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2025-08-14 - CVE-2025-8938 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8938

Vulnerability Analysis

The vulnerability affects the formSysTel handler within the boa web server used by the TOTOLINK N350R firmware. This handler processes system configuration requests for the Telnet Service. When an HTTP request supplies the TelEnabled parameter through /boafrm/formSysTel, the router enables a Telnet daemon that can be reached by remote clients. Because the Telnet interface itself is not intended to be exposed on production devices, the mechanism functions as a backdoor. An attacker with low privileges on the web interface can flip this parameter and gain interactive shell access on the device.

Root Cause

The root cause is hidden functionality in the firmware [CWE-912]. The formSysTel handler exposes a switch that enables a Telnet daemon without adequate access restrictions, authentication hardening, or transport security. Once enabled, Telnet transmits credentials in cleartext and typically drops the attacker into a shell running as a privileged system user.

Attack Vector

Exploitation occurs over the network by issuing a crafted HTTP request to /boafrm/formSysTel with the TelEnabled argument set to enable Telnet. The attack requires low-level authentication to the router web interface and no user interaction. After activation, the attacker connects to TCP port 23 and interacts with the device shell. Technical details and proof-of-concept steps are documented in the GitHub PoC Repository and VulDB #319901 Details.

// No verified exploit code is republished here.
// Refer to the linked PoC repository for the sanitized request structure.

Detection Methods for CVE-2025-8938

Indicators of Compromise

Unexpected HTTP POST requests to /boafrm/formSysTel containing the TelEnabled parameter.
New listening service on TCP port 23 on TOTOLINK N350R devices that previously had Telnet disabled.
Outbound or inbound Telnet sessions to router management IP addresses within the internal network.
Router configuration backups showing TelEnabled=1 where the baseline value was 0.

Detection Strategies

Inspect HTTP proxy or firewall logs for requests targeting formSysTel on router management interfaces.
Perform recurring network scans against known router IP ranges to identify open Telnet ports.
Baseline router configurations and alert on drift affecting Telnet or remote management settings.

Monitoring Recommendations

Enable NetFlow or IPFIX collection on segments that host consumer or small-office routers.
Alert on any TCP/23 traffic within corporate or trusted network segments.
Correlate router administrative logins with subsequent configuration writes to the formSysTel endpoint.

How to Mitigate CVE-2025-8938

Immediate Actions Required

Restrict access to the router web management interface to trusted management VLANs only.
Change default and shared credentials on the TOTOLINK N350R to remove the low-privilege exploitation path.
Block inbound TCP/23 at perimeter and internal segmentation points where Telnet is not required.
Audit affected devices for an active Telnet daemon and disable it where present.

Patch Information

At the time of publication, no vendor patch is referenced in the advisory data. Consult the TOTOLink Official Site for firmware updates. Where a fixed firmware is not available, replace the TOTOLINK N350R with a supported device or isolate it behind a hardened firewall.

Workarounds

Disable remote administration and confirm the Telnet service is off after every reboot or configuration change.
Place the router behind a segmentation firewall that blocks Telnet and restricts management protocols by source IP.
Retire end-of-life firmware builds such as 1.2.3-B20130826 from production networks.

bash

# Example: block Telnet at an upstream Linux gateway
iptables -A FORWARD -p tcp --dport 23 -j DROP
iptables -A INPUT   -p tcp --dport 23 -j DROP