CVE-2025-4460: Totolink N150rt Firmware XSS Vulnerability

CVE-2025-4460 Overview

CVE-2025-4460 is a cross-site scripting (XSS) vulnerability [CWE-79] in the TOTOLINK N150RT wireless router running firmware version 3.4.0-B20190525. The flaw resides in the URL Filtering page of the device's web administration interface. An authenticated attacker can inject malicious script content that executes in the browser of any administrator viewing the affected page. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse against exposed devices.

Critical Impact
Authenticated attackers can inject persistent JavaScript into the router's URL Filtering interface, enabling session hijacking, credential theft, and unauthorized configuration changes against the administrator.

Affected Products

TOTOLINK N150RT router hardware
TOTOLINK N150RT firmware version 3.4.0-B20190525
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2025-05-09 - CVE-2025-4460 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4460

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the URL Filtering component of the TOTOLINK N150RT web administration interface. The affected endpoint accepts user-supplied input, likely a URL or filter rule, and renders it back into HTML without proper output encoding or input sanitization.

Exploitation requires high privileges because the attacker must authenticate to the administrative interface before submitting the malicious payload. User interaction is also required, as the stored payload only triggers when an administrator views the URL Filtering page. Successful exploitation gives the attacker JavaScript execution in the context of the router's management origin.

An attacker who gains script execution in that context can modify router settings, pivot to internal network reconnaissance, exfiltrate the administrator's session, or alter DNS and firewall rules. A public proof-of-concept is referenced in the vulnerability disclosure, lowering the barrier to weaponization.

Root Cause

The root cause is missing output encoding when the URL Filtering page reflects stored filter entries back into the HTML response. The device accepts arbitrary characters, including <, >, and ", and inserts them into the DOM without HTML entity escaping. This classifies the flaw as improper neutralization of input during web page generation [CWE-79].

Attack Vector

The attack is delivered over the network against the router's HTTP management interface. The attacker authenticates with valid administrator credentials, navigates to the URL Filtering configuration, and submits a filter entry containing a JavaScript payload. The payload is stored in the device configuration. When any administrator later loads the URL Filtering page, the browser parses and executes the injected script. See the GitHub proof-of-concept writeup for the published exploitation details.

Detection Methods for CVE-2025-4460

Indicators of Compromise

URL Filtering rules containing HTML tags such as <script>, <img>, <svg>, or event handler attributes like onerror= and onload=
Unexpected outbound requests from administrator browsers to attacker-controlled domains immediately after loading the router management console
Administrative session cookies being transmitted to external hosts
Unauthorized changes to DNS, firewall, or port-forwarding configuration following a management session

Detection Strategies

Audit the stored URL Filtering configuration on all TOTOLINK N150RT devices for entries containing angle brackets, quotes, or JavaScript keywords
Inspect HTTP response bodies from router management traffic for unencoded script content served from the URL Filtering page
Correlate web proxy or DNS logs with administrator browsing sessions to the router's IP address to identify anomalous callouts

Monitoring Recommendations

Monitor administrative access to the router management interface and alert on logins from unexpected source addresses
Record and review all configuration changes to filtering, DNS, and firewall rule sets
Track browser telemetry on administrator workstations for script execution against internal RFC1918 addresses hosting embedded device UIs

How to Mitigate CVE-2025-4460

Immediate Actions Required

Restrict access to the N150RT web management interface to a trusted management VLAN or specific administrator hosts
Disable remote WAN-side management if enabled on affected devices
Review and purge any suspicious entries from the URL Filtering configuration
Change administrator credentials on all N150RT devices and avoid credential reuse across network equipment

Patch Information

No vendor advisory or firmware update addressing CVE-2025-4460 is listed in the available references. The N150RT running firmware 3.4.0-B20190525 is an aging consumer-grade router, and administrators should consult the TOTOLINK official website for any newer firmware release. Where no fix is available, consider replacing the device with a supported model.

Workarounds

Place the router management interface behind a network segment that only trusted administrator workstations can reach
Use a dedicated browser profile or isolated management jump host when accessing the N150RT administrative UI to limit the blast radius of script execution
Log out of the management interface immediately after configuration changes to invalidate the session cookie that an injected script could abuse

bash

# Example firewall rule restricting management access to a single admin host
# Replace 192.0.2.10 with the trusted admin IP and 192.168.1.1 with the router IP
iptables -A FORWARD -s 192.0.2.10 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP