CVE-2025-3996: Totolink N150RT Firmware XSS Vulnerability

CVE-2025-3996 Overview

CVE-2025-3996 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the TOTOLINK N150RT wireless router running firmware version 3.4.0-B20190525. The flaw resides in the MAC Filtering page accessed via /home.htm. An authenticated attacker can inject malicious script payloads through the Comment parameter, which the web interface renders without proper sanitization. The attack can be launched remotely against the router's administrative interface, and public exploit details have been disclosed.

Critical Impact
A remote authenticated attacker can inject persistent JavaScript into the router's administrative interface through the MAC Filtering Comment field, enabling session hijacking or administrative action abuse against any operator viewing the affected page.

Affected Products

TOTOLINK N150RT router (hardware)
TOTOLINK N150RT firmware version 3.4.0-B20190525
Web management component: MAC Filtering page (/home.htm)

Discovery Timeline

2025-04-28 - CVE-2025-3996 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3996

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the router's web administration interface. When an operator configures a MAC filtering rule through the MAC Filtering page, the interface accepts a Comment argument that is stored and later rendered back to administrators.

The firmware fails to encode or sanitize this input before writing it into the resulting HTML response served from /home.htm. As a result, script content supplied in the comment field executes within the browser session of any administrator who subsequently views the MAC Filtering configuration page.

Exploitation requires authenticated access with high privileges (the ability to modify MAC filtering rules) and user interaction from a victim administrator viewing the page. The scope of impact is limited to integrity of the rendered administrative interface.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The MAC Filtering handler stores the Comment argument verbatim and echoes it into /home.htm without applying HTML entity encoding or context-aware output escaping. Any characters that carry syntactic meaning in HTML, such as <, >, and quotes, are preserved and interpreted by the browser.

Attack Vector

The attack vector is network-based against the router's HTTP administrative interface. An attacker with valid administrative credentials submits a crafted MAC filtering entry containing script content in the Comment field. When any operator later loads the MAC Filtering page, the injected script executes in the browser under the origin of the router's management interface.

The injected script can read authentication cookies scoped to the management interface, issue authenticated requests to change router configuration, harvest wireless credentials, or pivot to internal network reconnaissance. Public proof-of-concept material describing the injection has been published to a GitHub PoC repository and cataloged under VulDB entry 306332.

No patched firmware release addressing this issue has been published by the vendor at the time of writing. See the TOTOLINK Official Website for firmware updates.

Detection Methods for CVE-2025-3996

Indicators of Compromise

MAC filtering rule entries containing HTML tags, <script> fragments, event handler attributes such as onerror or onload, or javascript: URIs in the Comment field.
Unexpected outbound requests originating from an administrator's browser immediately after loading the router management interface.
Administrator sessions exhibiting configuration changes that were not manually initiated, such as new MAC filter rules, altered DNS settings, or added remote management access.

Detection Strategies

Inspect the current MAC filtering configuration on affected N150RT devices and review each Comment field for HTML or JavaScript syntax.
Monitor HTTP traffic to the router management interface for POST requests that include tag characters or script keywords in the Comment parameter targeting /home.htm.
Correlate browser-based telemetry on administrator workstations for script execution events tied to the router's management IP address.

Monitoring Recommendations

Log and alert on all configuration changes to MAC filtering rules on TOTOLINK N150RT devices, especially those originating from unexpected source addresses.
Restrict web management access to a dedicated management VLAN and log all sessions to the router's HTTP interface.
Track administrative browser sessions for anomalous outbound requests following visits to /home.htm.

How to Mitigate CVE-2025-3996

Immediate Actions Required

Disable remote administration on affected N150RT devices and limit management access to trusted internal hosts only.
Rotate administrative credentials and audit all existing MAC filtering entries, removing any Comment values containing HTML or script syntax.
Consider replacing end-of-life or unpatched N150RT units in high-risk environments until vendor firmware addressing this issue is released.

Patch Information

As of the last NVD update on 2026-06-17, no vendor-supplied patch has been published for firmware 3.4.0-B20190525. Monitor the TOTOLINK Official Website and the VulDB advisory for firmware updates addressing CVE-2025-3996.

Workarounds

Restrict access to the router's HTTP management interface using network segmentation, firewall rules, or an access control list bound to specific administrative source addresses.
Use a dedicated, hardened browser profile with scripting disabled when accessing the N150RT management interface, and clear session cookies immediately after each session.
Avoid modifying MAC filtering rules through untrusted networks, and validate the Comment field content by direct inspection before saving new entries.

bash

# Example: restrict router management access to a single admin host on an upstream firewall
iptables -I FORWARD -p tcp -d <router_management_ip> --dport 80 -s <admin_workstation_ip> -j ACCEPT
iptables -I FORWARD -p tcp -d <router_management_ip> --dport 80 -j DROP