Buffer Overflow Vulnerability in TOTOLINK N150RT Firmware
CVE-2026-94952

9.8CRITICAL

Key Information:

Vendor

TOTOLINK
Status
N150RT
Vendor
CVE Published:
29 September 2026

What is CVE-2026-94952?

A stack-based buffer overflow vulnerability has been identified in the web management interface of TOTOLINK N150RT firmware. This vulnerability can be exploited via the port-forwarding configuration handler at the route /boafrm/formPortFw by manipulating the ip_subnet and fw_ip request parameters during the process of adding a new rule. Successful exploitation may allow an attacker to execute arbitrary code or cause denial of service, highlighting the importance of timely updates and secure firewall configurations.

References

https://gist.github.com/H3rmesk1t/0f2e6a120c92a3728277951...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.