Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-3990: TOTOLINK N150RT: Unsecured File Can Cause Buffer Overflow Attacks

CVE-2025-3990 · published 1 year ago

Summary

A critical issue exists in the TOTOLINK N150RT's file handling system. An attacker can exploit this vulnerability to cause a buffer overflow, potentially leading to remote attacks. We recommend updating to the latest version of the software to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
totolink	n150rt_firmware	3.4.0-b20190525 `cpe:2.3:o:totolink:n150rt_firmware:3.4.0-b20190525:::::::*`

Original advisory text

A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. Affected by this issue is some unknown functionality of the file /boafrm/formVlan. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

References

https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_f... Exploit
https://vuldb.com/?ctiid.306326 Permissions Required VDB Entry
https://vuldb.com/?id.306326 Third Party Advisory VDB Entry
https://vuldb.com/?submit.557941 Third Party Advisory VDB Entry
https://www.totolink.net/ Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.7 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-119Buffer Overflow

CWE-120Classic Buffer Overflow

Timeline

Published27 Apr 2025

Updated31 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-3990 · NVD

Track software like this

Free during beta