CVE-2026-94952
UnknownSummary
Stack-based buffer overflow in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. Reachable via /boafrm/formPortFw, triggered by ip_subnet and fw_ip parameters during rule addition.
Risk Assessment
A remote attacker can cause device crash or potentially execute arbitrary code, leading to full router compromise.
Recommendation
Update router firmware to the latest version if available, or restrict access to the management interface.
Other vulnerabilities in TOTOLINK N150RT
See all- CVE-2026-94953Unknown
Stack-based buffer overflow in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. Reachable via /boafrm/formAjaxSet with topicurl=setting/setWiFiRepeaterConfig and the ApCliWEPKey field.
- CVE-2026-94954Unknown
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formFilter (access-control / URL filter configuration handler) and is triggered by the url request parameter when the addFilterUrl (or addFilterUrlFlag) action flag is set.
- CVE-2026-100896Critical
Vulnerability in TOTOLINK N150RT 3.4.0-B20201030 in the system function of /boafrm/formWlSiteSurvey in the web management interface. Manipulation of the wlanif argument leads to OS command injection. Remote attack possible, exploit publicly available.
Original NVD description (English source)
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw (port-forwarding configuration handler) and is triggered by the ip_subnet and fw_ip request parameters during the rule-addition flow.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS