CVE-2026-3825
Received Received - Intake

Buffer Overflow in IFTOP_P4_181 Allows Remote Code Execution

Publication date: 2026-03-11

Last updated on: 2026-03-17

Assigner: TWCERT/CC

Description
IFTOP developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-11
Last Modified
2026-03-17
Generated
2026-07-26
AI Q&A
2026-03-11
EPSS Evaluated
2026-07-25
NVD
CVE-2026-3825
EUVD
EUVD-2026-11115

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wellchoose organization_portal_system to iftop_p4_181 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability relates to the software version IFTOP_P4_181 or earlier, and an update to version IFTOP_P4_181 or later addresses it.

The CVSS v3.1 score of 6.1 indicates a medium severity vulnerability that can be exploited remotely over a network without privileges but requires user interaction.

Detection Guidance

I don't know

Impact Analysis

The vulnerability can be exploited remotely without privileges but requires user interaction, potentially leading to partial confidentiality and integrity loss, but no impact on availability.

Compliance Impact

I don't know

Mitigation Strategies

The vulnerability can be mitigated by updating to version IFTOP_P4_181 or later.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart