CVE-2025-3993
📋 TL;DR
A critical buffer overflow vulnerability in TOTOLINK N150RT routers allows remote attackers to execute arbitrary code by manipulating the submit-url parameter in the /boafrm/formWsc endpoint. This affects users running vulnerable firmware versions, potentially leading to complete device compromise. Attackers can exploit this without authentication from the network.
💻 Affected Systems
- TOTOLINK N150RT
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Router takeover enabling traffic interception, DNS manipulation, and use as attack platform against internal network.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public exploit code available on GitHub. Attack requires sending crafted HTTP request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.totolink.net/
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates. 2. Download latest firmware. 3. Upload via web interface. 4. Reboot router.
🔧 Temporary Workarounds
Disable WAN Management
allPrevent external access to web management interface
Access router settings > Security > Remote Management > Disable
Network Segmentation
allIsolate router management interface to trusted network
Use firewall rules to restrict access to router IP on ports 80/443
🧯 If You Can't Patch
- Replace with supported router model
- Implement strict network ACLs blocking all external access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: Login > System > Firmware UpgradeCheck Version:
curl -s http://router-ip/ | grep -i firmwareVerify Fix Applied:
Verify firmware version is newer than 3.4.0-B20190525📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /boafrm/formWsc with long submit-url parameters
- Unusual POST requests to router management interface
Network Indicators:
- HTTP traffic to router IP with buffer overflow patterns in payload
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND uri="/boafrm/formWsc" AND (param_length>100 OR contains(param,"submit-url"))