CVE-2026-94954
UnknownSummary
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formFilter (access-control / URL filter configuration handler) and is triggered by the url request parameter when the addFilterUrl (or addFilterUrlFlag) action flag is set.
Risk Assessment
An attacker could remotely exploit the vulnerability to execute arbitrary code or cause a denial of service. This may lead to router compromise and network traffic control.
Recommendation
Update TOTOLINK N150RT firmware to the latest version if available. If not, consider disabling remote management or restricting access to the web interface.
Other vulnerabilities in TOTOLINK N150RT
See all- CVE-2026-94952Unknown
Stack-based buffer overflow in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. Reachable via /boafrm/formPortFw, triggered by ip_subnet and fw_ip parameters during rule addition.
- CVE-2026-94953Unknown
Stack-based buffer overflow in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. Reachable via /boafrm/formAjaxSet with topicurl=setting/setWiFiRepeaterConfig and the ApCliWEPKey field.
- CVE-2026-100896Critical
Vulnerability in TOTOLINK N150RT 3.4.0-B20201030 in the system function of /boafrm/formWlSiteSurvey in the web management interface. Manipulation of the wlanif argument leads to OS command injection. Remote attack possible, exploit publicly available.
Original NVD description (English source)
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formFilter (access-control / URL filter configuration handler) and is triggered by the url request parameter when the addFilterUrl (or addFilterUrlFlag) action flag is set.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS