CVE-2025-3991
📋 TL;DR
This critical buffer overflow vulnerability in TOTOLINK N150RT routers allows remote attackers to execute arbitrary code by manipulating the submit-url parameter. Attackers can exploit this without authentication to potentially take full control of affected devices. All users of TOTOLINK N150RT routers with firmware version 3.4.0-B20190525 are affected.
💻 Affected Systems
- TOTOLINK N150RT
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, and persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a botnet node.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal exploitation remains possible.
🎯 Exploit Status
Public exploit code is available in GitHub repositories, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.totolink.net/
Restart Required: Yes
Instructions:
1. Check TOTOLINK website for firmware updates. 2. Download latest firmware. 3. Access router web interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router admin panel → System Tools → Remote Management → Disable
Network Segmentation
allIsolate router management interface from user networks
🧯 If You Can't Patch
- Replace affected devices with supported models
- Implement strict network access controls to limit access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface: System Tools → Firmware UpgradeCheck Version:
curl -s http://router-ip/ | grep -i firmwareVerify Fix Applied:
Verify firmware version is no longer 3.4.0-B20190525 after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /boafrm/formWdsEncrypt
- Large payloads in submit-url parameter
- Multiple failed buffer overflow attempts
Network Indicators:
- Unusual traffic patterns to router management interface
- Exploit-specific payloads in HTTP requests
SIEM Query:
source="router_logs" AND (uri="/boafrm/formWdsEncrypt" OR "submit-url" AND data_size>1000)