CVE-2025-8938
📋 TL;DR
This vulnerability in TOTOLINK N350R routers allows attackers to enable a backdoor via the Telnet service by manipulating the TelEnabled parameter. Attackers can exploit this remotely to gain unauthorized access to affected devices. Only TOTOLINK N350R routers running firmware version 1.2.3-B20130826 are affected.
💻 Affected Systems
- TOTOLINK N350R
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to intercept network traffic, modify configurations, install persistent malware, and pivot to internal networks.
Likely Case
Unauthorized access to router administration leading to network disruption, DNS hijacking, or credential theft from connected devices.
If Mitigated
Limited impact if Telnet service is disabled and router is not internet-facing, though local network attacks remain possible.
🎯 Exploit Status
Public proof-of-concept exploit code is available on GitHub. Exploitation requires network access to the Telnet service on port 23.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch is available. Check TOTOLINK website for firmware updates. If no update exists, consider replacing affected hardware.
🔧 Temporary Workarounds
Disable Telnet Service
allDisable the Telnet service completely to prevent exploitation of this vulnerability.
Access router admin interface → Advanced Settings → Telnet → Disable
Restrict Network Access
allUse firewall rules to block external access to Telnet port 23 and restrict internal access to trusted IPs only.
iptables -A INPUT -p tcp --dport 23 -j DROP
iptables -A INPUT -p tcp --dport 23 -s trusted_ip -j ACCEPT
🧯 If You Can't Patch
- Replace affected TOTOLINK N350R routers with newer models or different brands that receive security updates
- Segment affected routers on isolated network segments to limit potential damage from compromise
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.2.3-B20130826, the device is vulnerable. Also test if Telnet service responds on port 23.Check Version:
Login to router admin interface and check System Status or Firmware Version pageVerify Fix Applied:
Verify Telnet service is disabled by attempting to connect to port 23 (telnet router_ip 23) - connection should be refused.📡 Detection & Monitoring
Log Indicators:
- Unusual Telnet connection attempts
- Configuration changes to Telnet settings
- Failed authentication attempts on Telnet port
Network Indicators:
- Unexpected traffic on Telnet port 23
- Telnet connections from unusual IP addresses
- Telnet service enabled when it should be disabled
SIEM Query:
source_port:23 OR destination_port:23 AND (action:denied OR action:allowed) | stats count by src_ip, dest_ip