CVE-2025-63466: High severity TOTOLINK LR350 vulnerability

Published Oct 31, 2025

Updated

Totolink LR350 v9.3.5u.6369B20220309 was discovered to contain a stack overflow via the password parameter in the sub426EF8 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Affected Software

3 affected components

TOTOLINK LR350

All of the following

TOTOLINK Lr350 Firmware=9.3.5u.6369_b20220309

TOTOLINK LR350

Event History

Oct 31, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-63466?

CVE-2025-63466 has a high severity as it can lead to a Denial of Service (DoS) with potential impact on the availability of Totolink LR350 devices.

How do I fix CVE-2025-63466?

To mitigate CVE-2025-63466, it is recommended to update the firmware of the Totolink LR350 to the latest version provided by the vendor.

What does CVE-2025-63466 affect?

CVE-2025-63466 specifically affects the Totolink LR350 router running firmware version v9.3.5u.6369_B20220309.

What type of vulnerability is CVE-2025-63466?

CVE-2025-63466 is a stack overflow vulnerability caused by improper handling of the password parameter.

Can CVE-2025-63466 be exploited remotely?

Yes, CVE-2025-63466 can be exploited remotely through crafted requests targeting the affected functionality.