Sign-up

ID

VAR-202505-0299


CVE

CVE-2025-4461


TITLE

TOTOLINK  of  N150RT  Cross-site scripting vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-005646

DESCRIPTION

A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. TOTOLINK of N150RT The firmware contains cross-site scripting and code injection vulnerabilities.Information may be obtained and information may be tampered with. TOTOLINK N150RT is a wireless router produced by China's TOTOLINK Electronics. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2025-4461 // JVNDB: JVNDB-2025-005646 // CNVD: CNVD-2025-10936

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-10936

AFFECTED PRODUCTS

vendor:totolinkmodel:n150rtscope:eqversion:3.4.0-b20190525

Trust: 1.0

vendor:totolinkmodel:n150rtscope: - version: -

Trust: 0.8

vendor:totolinkmodel:n150rtscope:eqversion: -

Trust: 0.8

vendor:totolinkmodel:n150rtscope:eqversion:n150rt firmware 3.4.0-b20190525

Trust: 0.8

vendor:totolinkmodel:n150rt 3.4.0-b20190525scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-10936 // JVNDB: JVNDB-2025-005646 // NVD: CVE-2025-4461

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-4461
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2025-4461
value: MEDIUM

Trust: 1.0

OTHER: JVNDB-2025-005646
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2025-10936
value: LOW

Trust: 0.6

cna@vuldb.com: CVE-2025-4461
severity: LOW
baseScore: 3.3
vectorString: AV:N/AC:L/AU:M/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-005646
severity: LOW
baseScore: 3.3
vectorString: AV:N/AC:L/AU:M/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-10936
severity: LOW
baseScore: 3.3
vectorString: AV:N/AC:L/AU:M/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-4461
baseSeverity: LOW
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 0.9
impactScore: 1.4
version: 3.1

Trust: 1.0

nvd@nist.gov: CVE-2025-4461
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.1

Trust: 1.0

NVD: JVNDB-2025-005646
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-10936 // JVNDB: JVNDB-2025-005646 // NVD: CVE-2025-4461 // NVD: CVE-2025-4461

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.0

problemtype:CWE-94

Trust: 1.0

problemtype:Cross-site scripting (CWE-79) [ others ]

Trust: 0.8

problemtype: Cross-site scripting (CWE-79) [NVD evaluation ]

Trust: 0.8

problemtype: Code injection (CWE-94) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-005646 // NVD: CVE-2025-4461

PATCH

title:Patch for TOTOLINK N150RT Virtual Server Page component cross-site scripting vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/692431

Trust: 0.6

sources: CNVD: CNVD-2025-10936

EXTERNAL IDS

db:NVDid:CVE-2025-4461

Trust: 3.2

db:VULDBid:308080

Trust: 1.8

db:JVNDBid:JVNDB-2025-005646

Trust: 0.8

db:CNVDid:CNVD-2025-10936

Trust: 0.6

sources: CNVD: CNVD-2025-10936 // JVNDB: JVNDB-2025-005646 // NVD: CVE-2025-4461

REFERENCES

url:https://github.com/fizz-is-on-the-way/iot_vuls/tree/main/n150rt/xss_virtual_server

Trust: 2.4

url:https://vuldb.com/?id.308080

Trust: 1.8

url:https://vuldb.com/?submit.565957

Trust: 1.8

url:https://www.totolink.net/

Trust: 1.8

url:https://vuldb.com/?ctiid.308080

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2025-4461

Trust: 0.8

sources: CNVD: CNVD-2025-10936 // JVNDB: JVNDB-2025-005646 // NVD: CVE-2025-4461

SOURCES

db:CNVDid:CNVD-2025-10936
db:JVNDBid:JVNDB-2025-005646
db:NVDid:CVE-2025-4461

LAST UPDATE DATE

2025-05-30T23:25:25.532000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-10936date:2025-05-29T00:00:00
db:JVNDBid:JVNDB-2025-005646date:2025-05-26T02:36:00
db:NVDid:CVE-2025-4461date:2025-05-23T12:33:21.447

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-10936date:2025-05-29T00:00:00
db:JVNDBid:JVNDB-2025-005646date:2025-05-26T00:00:00
db:NVDid:CVE-2025-4461date:2025-05-09T05:15:52.093