Overview
A critical vulnerability, CVE-2025-6400, has been discovered in the TOTOLINK N300RH series routers. This vulnerability affects version 6.1c.1390_B20191101 of the product. The vulnerability is located in an unknown functionality of the file /boafrm/formPortFw of the HTTP POST Message Handler component. This vulnerability has the potential to compromise systems or lead to data leakage. Given the widespread use of TOTOLINK routers, this vulnerability could have a significant impact on organizations and individuals alike.
Vulnerability Summary
CVE ID: CVE-2025-6400
Severity: Critical-CVSS Severity Score 8.8
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
TOTOLINK N300RH | 6.1c.1390_B20191101
How the Exploit Works
The vulnerability exists due to improper handling of the ‘service_type’ argument in the HTTP POST Message Handler component. A remote attacker can send a specially crafted HTTP POST request with a malicious ‘service_type’ argument that exceeds the expected input length. This leads to a buffer overflow condition, which could allow the attacker to execute arbitrary code on the system or cause the application to crash, resulting in a denial of service.
Conceptual Example Code
The following is a conceptual example of the exploit:
POST /boafrm/formPortFw HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
service_type=AAAAAAAAAAAA... [long string of A's to overflow the buffer]This request involves sending an HTTP POST request to the /boafrm/formPortFw endpoint with a ‘service_type’ parameter containing an artificially long string, which overflows the buffer.
Mitigation
Users of TOTOLINK N300RH version 6.1c.1390_B20191101 are advised to apply the vendor patch immediately to mitigate this vulnerability. If the patch cannot be applied immediately, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as a temporary mitigation strategy. Regularly update and patch your systems to prevent similar vulnerabilities in the future.