PT-2025-18031 · Totolink · Totolink N150Rt

Lcyf-Fizz · Published 2025-04-06 · Updated 2025-04-28 · CVE-2025-3994

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK N150RT version 3.4.0-B20190525

Description A problematic issue has been found, affecting an unknown function of the file /home.htm of the IP Port Filtering component. The manipulation of the Comment argument leads to cross-site scripting. This issue can be exploited remotely.

Recommendations For TOTOLINK N150RT version 3.4.0-B20190525, as a temporary workaround, consider restricting access to the IP Port Filtering component to minimize the risk of exploitation. Avoid using the Comment argument in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

BDU:2025-05371

CVE-2025-3994

Affected Products

Totolink N150Rt

References · 12

• 🔥 https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/XSS_IP_Port_filering · Exploit
• https://bdu.fstec.ru/vul/2025-05371 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3994 · Security Note
• https://t.me/cvenotify/119986 · Telegram Post
• https://t.me/cvetracker/22490 · Telegram Post
• https://vuldb.com/?id.306330 · Note
• https://twitter.com/VulmonFeeds/status/1916667492744769968 · Twitter Post
• https://totolink.net · Note
• https://t.me/cvedetector/23875 · Telegram Post
• https://vuldb.com/?ctiid.306330 · Note
• https://vuldb.com/?submit.557945 · Note