CVE-2025-3991

🗓️ 27 Apr 2025 23:31:05Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 60 Views🌐 WEB

Critical buffer overflow vulnerability in TOTOLINK N150RT allows remote attacks via submit-url.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of TOTOLINK N150RT router microprogramming software, related to the execution of operations outside the buffer in memory, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.	9 May 202500:00	–	bdu_fstec
Circl	CVE-2025-3991	28 Apr 202500:10	–	circl
CNNVD	TOTOLINK N150RT 安全漏洞	27 Apr 202500:00	–	cnnvd
CNVD	TOTOLINK N150RT /boafrm/formWdsEncrypt File Buffer Overflow Vulnerability	30 Apr 202500:00	–	cnvd
Cvelist	CVE-2025-3991 TOTOLINK N150RT formWdsEncrypt buffer overflow	27 Apr 202523:31	–	cvelist
EUVD	EUVD-2025-12418	3 Oct 202520:07	–	euvd
NVD	CVE-2025-3991	28 Apr 202500:15	–	nvd
OSV	CVE-2025-3991	28 Apr 202500:15	–	osv
Positive Technologies	PT-2025-18024 · Totolink · Totolink N150Rt	6 Apr 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-3991	30 Apr 202500:09	–	redhatcve

NVD

Node

totolink n150rt_firmwareMatch3.4.0-b20190525

AND

totolink n150rtMatch2.0

[
  {
    "vendor": "TOTOLINK",
    "product": "N150RT",
    "versions": [
      {
        "version": "3.4.0-B20190525",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
totolink	www.totolink.net/
vuldb	www.vuldb.com/
github	www.github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formWdsEncrypt
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
submit-url	request body	boafrm/formWdsEncrypt	Buffer overflow via manipulation of submit-url parameter in /boafrm/formWdsEncrypt (remote exploit disclosed).	CWE-119, CWE-120

17 Jun 2026 09:21Current

8.9High risk

Vulners AI Score8.9

CVSS 48.7

CVSS 3.18.8

CVSS 29

CVSS 38.8

EPSS0.00852

SSVC