CVE-2025-3987

🗓️ 27 Apr 2025 21:31:06Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 61 Views🌐 WEB

Critical command injection vulnerability in TOTOLINK N150RT remote exploitation possible.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-3987	27 Apr 202522:09	–	circl
CNNVD	TOTOLINK N150RT 注入漏洞	27 Apr 202500:00	–	cnnvd
CNVD	TOTOLINK N150RT Command Injection Vulnerability (CNVD-2025-09944)	30 Apr 202500:00	–	cnvd
Cvelist	CVE-2025-3987 TOTOLINK N150RT formWsc command injection	27 Apr 202521:31	–	cvelist
EUVD	EUVD-2025-12424	3 Oct 202520:07	–	euvd
NVD	CVE-2025-3987	27 Apr 202522:15	–	nvd
OSV	CVE-2025-3987	27 Apr 202522:15	–	osv
Positive Technologies	PT-2025-18018 · Totolink · Totolink N150Rt	6 Apr 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-3987	29 Apr 202522:15	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2025-3987	19 Oct 202500:00	–	vulncheck_kev

NVD

Node

totolink n150rt_firmwareMatch3.4.0-b20190525

AND

totolink n150rtMatch2.0

[
  {
    "vendor": "TOTOLINK",
    "product": "N150RT",
    "versions": [
      {
        "version": "3.4.0-B20190525",
        "status": "affected"
      }
    ]
  }
]

Source	Link
totolink	www.totolink.net/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/RCE_formWsc
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
localPin	request body	/boafrm/formWsc	Command injection via manipulation of localPin in formWsc endpoint.	CWE-74, CWE-77

07 May 2025 18:36Current

7High risk

Vulners AI Score7

CVSS 3.16.3 - 8.8

CVSS 45.3

CVSS 26.5

CVSS 36.3

EPSS0.1045

SSVC

cve 2025 3987 totolink n150rt command injection remote exploitation critical vulnerability