Cyber Resilience

CVE-2025-8938

Low

Published: 14 August 2025

Published
14 August 2025
Modified
29 April 2026
KEV Added
—
Patch
—
CVSS Score v4 2.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0027 50.4th percentile
Risk Priority 4 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-8938 is a low-severity Hidden Functionality (CWE-912) vulnerability in Totolink N350R Firmware. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet Service. The manipulation of the argument TelEnabled leads to backdoor. The attack may be initiated remotely. The exploit…

more

has been disclosed to the public and may be used.

CWE(s)
CWE-912

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

The backdoor vulnerability in the router's web interface (/boafrm/formSysTel) allows remote manipulation of TelEnabled to launch telnetd, enabling exploitation of a public-facing application (T1190) and command/script execution via network device CLI (T1059.008).

Affected Assets

totolink
n350r firmware
1.2.3-b20130826

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CM-8 System Component Inventory
addresses: CWE-912

Documenting every system component at the required granularity and reviewing the inventory detects or prevents hidden functionality from remaining undetected.

CP-10 System Recovery and Reconstitution
addresses: CWE-912

Recovery eliminates hidden functionality or backdoors introduced during compromise.

PM-30 Supply Chain Risk Management Strategy
addresses: CWE-912

Policy requires supplier transparency and testing to detect hidden functionality or backdoors inserted in the supply chain.

PS-2 Position Risk Designation
addresses: CWE-912

Screening high-risk technical positions lowers the probability that hidden functionality or backdoors will be added by authorized personnel.

RA-10 Threat Hunting
addresses: CWE-912

Hunting identifies hidden functionality used for persistence or evasion after initial compromise.

RA-6 Technical Surveillance Countermeasures Survey
addresses: CWE-912

TSCM surveys discover and eliminate hidden surveillance functionality that would otherwise remain undetected in the environment.

SA-10 Developer Configuration Management
addresses: CWE-912

Change control, approval gates, and flaw tracking force hidden functionality to be either documented or discovered and removed.

SA-12 Supply Chain Protection
addresses: CWE-912

Vetting and integrity controls during acquisition reduce the likelihood of hidden backdoors or malicious functionality introduced by suppliers.

References