CVE-2025-8938 TOTOLINK N350R Telnet Service formSysTel backdoor
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2025-8938?
CVE-2025-8938 is a medium-severity vulnerability in TOTOLINK N350R, published on 14 Aug 2025.
Official description
A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet Service. The manipulation of the argument TelEnabled leads to backdoor. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Weakness: CWE-912
Which versions are affected by CVE-2025-8938?
It affects 1 product.
Products include Totolink N350r Firmware.
How do I fix CVE-2025-8938?
No fix has been published for CVE-2025-8938 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-8938 being exploited?
There is no known exploitation of CVE-2025-8938 in the wild and no public exploit code.
Other vulnerabilities in TOTOLINK N350R
Sources
Also known as GHSA-3cc5-q36c-j82w.