CVE-2025-3992: Totolink N150rt Buffer Overflow Vulnerability

CVE-2025-3992 Overview

CVE-2025-3992 is a buffer overflow vulnerability in TOTOLINK N150RT routers running firmware version 3.4.0-B20190525. The flaw resides in the /boafrm/formWlwds endpoint, where the submit-url argument is processed without proper bounds checking. Attackers can trigger memory corruption remotely by sending a crafted request containing an oversized submit-url value. The exploit details have been disclosed publicly through VulDB and a GitHub proof-of-concept repository, increasing the likelihood of opportunistic attacks against exposed devices.

Critical Impact
Remote attackers with low-level privileges can corrupt router memory through the submit-url parameter, potentially leading to denial of service or arbitrary code execution on the embedded device.

Affected Products

TOTOLINK N150RT router (hardware version 2.0)
TOTOLINK N150RT firmware 3.4.0-B20190525
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2025-04-28 - CVE-2025-3992 published to NVD
2025-05-12 - Last updated in NVD database

Technical Details for CVE-2025-3992

Vulnerability Analysis

The vulnerability exists in the HTTP handler that processes wireless configuration requests at /boafrm/formWlwds within the boa web server embedded in the N150RT firmware. When the handler reads the submit-url POST parameter, it copies the attacker-controlled string into a fixed-size stack buffer without validating the input length. Submitting a long submit-url value overflows the destination buffer and corrupts adjacent stack data, including saved return addresses.

The weakness is classified under [CWE-119] Improper Restriction of Operations within the Bounds of a Memory Buffer and [CWE-120] Buffer Copy without Checking Size of Input. Successful exploitation can crash the boa process, reboot the device, or, with reliable shellcode tailored to the MIPS architecture used by the N150RT, redirect execution to attacker-supplied code.

Root Cause

The formWlwds request handler trusts the length of the submit-url parameter supplied by clients. The firmware uses unbounded string copy operations such as strcpy or sprintf against a stack buffer, with no preceding length check or use of safer counted variants. This pattern is recurrent across TOTOLINK CGI handlers and reflects insufficient input validation throughout the web management interface.

Attack Vector

The attack vector is network-based and requires only low-privilege authentication to the router's web interface. An attacker on the same network, or one able to reach the management port from the internet when remote administration is enabled, can submit a single POST request to /boafrm/formWlwds with an oversized submit-url value to trigger the overflow. No user interaction is required, and the exploit has been published with reproducible steps in a public GitHub repository linked from VulDB entry #306328.

A verified proof-of-concept is available at the GitHub PoC Repository. No sanitized exploitation code is reproduced here.

Detection Methods for CVE-2025-3992

Indicators of Compromise

POST requests to /boafrm/formWlwds containing abnormally long submit-url parameter values
Repeated crashes or unexpected reboots of N150RT devices following inbound HTTP traffic to the management interface
Outbound connections from the router to unfamiliar hosts after suspicious HTTP requests
Log gaps or boa process restarts on affected firmware version 3.4.0-B20190525

Detection Strategies

Inspect HTTP traffic directed at TOTOLINK management endpoints and flag requests where submit-url exceeds expected length thresholds
Deploy network IDS signatures matching POST requests to /boafrm/formWlwds with payload lengths inconsistent with normal client behavior
Correlate router availability events with preceding HTTP traffic from internal or external sources

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized analytics platform for retention and search
Alert on any external source attempting to access the router's web administration interface
Monitor for new device fingerprints, DNS changes, or routing modifications on networks containing N150RT hardware

How to Mitigate CVE-2025-3992

Immediate Actions Required

Disable remote (WAN-side) management on all N150RT devices until a firmware update is available
Restrict LAN access to the router's web interface to a dedicated administrative VLAN or trusted IP range
Rotate router administrator credentials, since exploitation requires authenticated access
Inventory all TOTOLINK N150RT devices running firmware 3.4.0-B20190525 and prioritize replacement or isolation

Patch Information

At the time of publication, no vendor patch has been referenced in the NVD entry or on the Totolink Security Resource page. Administrators should monitor the vendor site for firmware updates superseding 3.4.0-B20190525. Additional vulnerability metadata is tracked in VulDB CTI ID #306328 and VulDB entry #306328.

Workarounds

Place affected routers behind a network firewall that blocks inbound HTTP/HTTPS to the management interface
Segment IoT and consumer-grade networking equipment away from sensitive production assets
Replace end-of-life N150RT hardware with current models that receive active security maintenance
Apply egress filtering on networks containing the device to limit post-compromise lateral movement

bash

# Example: block external access to the router management interface using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -i <wan_iface> -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -i <wan_iface> -j DROP