CVE-2025-3987

MEDIUM EXPLOITED

TOTOLINK N150RT 3.4.0-B20190525 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-3987 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.306323
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.306323
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.557938
Product product
https://www.totolink.net/

Scores

CVSS v3 6.3
EPSS 0.0889
EPSS Percentile 92.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2025-10-19
CWE
CWE-74 CWE-77
Status published
Products (1)
totolink/n150rt_firmware 3.4.0-b20190525
Published Apr 27, 2025
Tracked Since Feb 18, 2026