CVE-2026-7219
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A buffer overflow vulnerability has been found in Totolink N300RT 3.4.0-B20250430 in an unknown function of the file /boafrm/formIpQoS. Manipulating the argument entry_name can lead to buffer overflow, and the attack can be performed remotely. The exploit has been published and may be used.
Risk Assessment
The organization is at risk of remote code execution or device crash, which could lead to network disruption and loss of traffic control.
Recommendation
Immediately check for firmware updates from the vendor and apply them, and restrict access to the router's administrative interface to trusted networks only.
Other vulnerabilities in Totolink N300RT
See all- CVE-2025-34319Critical
TOTOLINK N300RT routers with firmware before V3.4.0-B20250430 have an OS command injection vulnerability in the Boa formWsc handling. An unauthenticated attacker can send crafted requests to execute commands via the targetAPSsid parameter.
- CVE-2026-7218High
A buffer overflow vulnerability was detected in the Totolink N300RT router version 3.4.0-B20250430 in the is_cmd_string_valid function in /boafrm/formWsc of the libapmib.so component. Manipulating the localPin argument causes a buffer overflow. The attack can be carried out remotely, and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in Totolink N300RT 3.4.0-B20250430. This affects an unknown function of the file /boafrm/formIpQoS. Executing a manipulation of the argument entry_name can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.