CVE-2025-63468
📋 TL;DR
This CVE describes a stack overflow vulnerability in Totolink LR350 routers via the http_host parameter. Attackers can exploit this to cause Denial of Service (DoS) by sending specially crafted requests. Users running Totolink LR350 v9.3.5u.6369_B20220309 are affected.
💻 Affected Systems
- Totolink LR350
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, potentially disrupting all network services for connected devices.
Likely Case
Router becomes unresponsive, requiring reboot to restore functionality, causing temporary network outage.
If Mitigated
With proper network segmentation and access controls, impact limited to isolated network segment.
🎯 Exploit Status
Public GitHub repository contains technical details and proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Check Totolink website for firmware updates.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable HTTP/HTTPS management access to prevent exploitation.
Restrict Management Access
allConfigure firewall rules to only allow management access from trusted IP addresses.
🧯 If You Can't Patch
- Segment affected routers to isolated network zones
- Implement network monitoring for abnormal HTTP requests to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at System Status > Firmware VersionCheck Version:
Check via router web interface or SSH if enabledVerify Fix Applied:
Verify firmware version has been updated beyond v9.3.5u.6369_B20220309📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP requests with long http_host parameters
- Router crash/reboot events in system logs
Network Indicators:
- Unusual HTTP traffic to router management port (typically 80/443)
- Router becoming unresponsive to legitimate requests
SIEM Query:
source="router_logs" AND (http_host.length>100 OR "crash" OR "reboot")