CVE-2025-4461 Overview
CVE-2025-4461 is a cross-site scripting (XSS) vulnerability in the TOTOLINK N150RT wireless router running firmware version 3.4.0-B20190525. The flaw resides in the Virtual Server configuration page of the router's web management interface. An authenticated attacker can inject arbitrary script content that executes in the browser of any user viewing the affected page. The vulnerability is remotely exploitable over the network and requires user interaction to trigger the injected payload. Public disclosure includes a proof-of-concept published to a GitHub repository, increasing the likelihood of opportunistic exploitation against exposed devices.
Critical Impact
An authenticated attacker can inject persistent JavaScript into the router's Virtual Server page, enabling session hijacking, credential theft, or unauthorized configuration changes when an administrator views the affected page.
Affected Products
- TOTOLINK N150RT router (hardware)
- TOTOLINK N150RT firmware version 3.4.0-B20190525
- Deployments exposing the router web administration interface to untrusted users
Discovery Timeline
- 2025-05-09 - CVE-2025-4461 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4461
Vulnerability Analysis
The vulnerability is a stored or reflected cross-site scripting flaw [CWE-79] in the Virtual Server configuration component of the TOTOLINK N150RT web interface. The router accepts user-supplied input for virtual server entries without sufficient output encoding or input sanitization. When an administrator subsequently views the Virtual Server page, the browser renders the attacker-controlled content as executable JavaScript within the trusted context of the router's management origin.
Exploitation requires an authenticated session with privileges to modify Virtual Server entries. The impact is limited to confidentiality and integrity within the browser context of the victim. However, because the router's web interface controls network routing, port forwarding, and firewall behavior, script execution in an administrator session can be leveraged to alter device configuration or steal session material.
Root Cause
The root cause is improper neutralization of input during web page generation. The Virtual Server handler stores or echoes user-provided field values directly into the HTML response without contextual encoding. This allows HTML and JavaScript tokens supplied by the attacker to break out of the intended data context and execute as markup.
Attack Vector
The attack is initiated remotely over the network against the router's HTTP management interface. An attacker with valid administrative credentials submits a crafted payload into a Virtual Server field. Delivery to a victim occurs when a legitimate administrator loads the Virtual Server page, at which point the injected script executes with the origin of the router's management console. A public proof-of-concept demonstrating the injection path is available in a GitHub PoC Repository.
No verified exploit code is reproduced here. Refer to the linked repository for technical reproduction details.
Detection Methods for CVE-2025-4461
Indicators of Compromise
- Unexpected HTML tags, <script> elements, or JavaScript event handlers (for example onerror=, onload=) present in Virtual Server entry fields when reviewing router configuration exports.
- Administrator sessions issuing configuration changes that do not correspond to known change tickets or maintenance windows.
- Outbound HTTP requests from administrator workstations to attacker-controlled hosts immediately after loading the router management interface.
Detection Strategies
- Inspect router configuration backups for non-alphanumeric characters in Virtual Server name, description, and port fields.
- Monitor HTTP responses from the router management interface for unencoded input in dynamically generated pages.
- Alert on administrator browser sessions that generate unexpected cross-origin requests shortly after accessing the router configuration UI.
Monitoring Recommendations
- Log all authenticated access to the router management interface and correlate with the source workstation identity.
- Restrict management-plane access to a dedicated administrative VLAN and monitor for connections from other network segments.
- Track browser telemetry from workstations that administer network infrastructure to detect anomalous script execution.
How to Mitigate CVE-2025-4461
Immediate Actions Required
- Restrict access to the router web management interface to trusted administrator workstations using access control lists.
- Disable remote WAN-side management on the N150RT and require management only from the internal LAN.
- Rotate administrator credentials and audit existing Virtual Server entries for unexpected content.
- Instruct administrators to clear browser sessions and cookies after configuring the device.
Patch Information
No vendor advisory or firmware patch has been published in the referenced sources at the time of NVD update. Consult the TOTOLINK official website for firmware release notes and updates. Additional tracking is available at VulDB entry #308080.
Workarounds
- Segment the router management network so only a small set of trusted hosts can reach the HTTP administration interface.
- Use a dedicated hardened browser profile with script restrictions when administering the router.
- Consider replacing the N150RT with a supported device if no vendor patch becomes available, as the firmware appears to be legacy.
# Example: restrict router management access to a single admin host using iptables on an upstream gateway
iptables -A FORWARD -s 192.0.2.10 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
