CVE-2025-3994: TOTOLINK N150RT IP Port Filtering home.htm cross site scripting

Severity: low (CVSS 3.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-04-28 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been classified as problematic. Affected is an unknown function of the file /home.htm of the component IP Port Filtering. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

TOTOLINK N150RT: 3.4.0-b20190525

References

https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/XSS_IP_Port_filering
https://vuldb.com/?ctiid.306330
https://vuldb.com/?id.306330
https://vuldb.com/?submit.557945
https://www.totolink.net/

Get alerted when CVE-2025-3994 or the next vulnerability affects your stack