What is the CVSS score of CVE-2026-94952?

CVE-2026-94952 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-94952?

Within 24 hours, inventory all TOTOLINK N150RT devices running firmware V3.4.0-B20201030 and ensure their web management interfaces are not exposed to the internet by blocking WAN access and restricting management to trusted LAN segments only. Within 7 days, implement network monitoring for exploitation attempts targeting the /boafrm/formPortFw endpoint with oversized ip_subnet or fw_ip parameters, enforce strong administrative credentials, and contact TOTOLINK for patch availability. Within 30 days, if no patch is released, isolate or replace affected devices, or deploy virtual patching through an intrusion prevention system or web application firewall if feasible, and conduct a risk assessment to determine if continued use is acceptable.

TOTOLINK N150RT CVE-2026-94952

EUVD-2026-89470 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-09-29 mitre

GHSA-mxg2-p493-cj5j

Buffer Overflow Stack Overflow TOTOLINK

9.8

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach router web interface (LAN or exposed WAN)
Delivery

POST to /boafrm/formPortFw adding rule
Exploit

Overflow ip_subnet/fw_ip stack buffer
Execution

Hijack control flow
Impact

Execute arbitrary code on router

Vulnerability Assessment

Weakness	CWE CWE-121 ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires the attacker to reach the web management interface of a TOTOLINK N150RT (NTR150) running firmware V3.4.0-B20201030 and send a request to the /boafrm/formPortFw port-forwarding handler with oversized ip_subnet and/or fw_ip parameters via the rule-addition flow. The supplied CVSS asserts no authentication (PR:N), but port-forwarding configuration is normally an admin-authenticated function - confirm from the PoC whether a valid admin session/CSRF is needed, as that is the decisive limiting factor. Exploitation is further limited to this specific model and firmware build, and realistic exposure is primarily LAN-side unless the management interface is deliberately exposed to the WAN.
Impact	Raw severity is maximal: the input CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) models a remote, unauthenticated, low-complexity stack overflow with full CIA impact - code execution on the device. However, several signals temper real-world priority. No EPSS score and no CISA KEV entry are provided, so there is no evidence of active or widespread exploitation. A public technical writeup/PoC gist (H3rmesk1t) is referenced, so exploit code is publicly available - but PoC availability is NOT the same as active exploitation. The biggest data tension is the PR:N claim: /boafrm/formPortFw is a port-forwarding CONFIGURATION handler, a function normally reachable only after authenticating to the router admin panel. Boa-based TOTOLINK endpoints are frequently reachable pre-authentication, but this is not confirmed here - verify with the PoC whether a session is required. If authentication is in fact required, effective risk drops from internet-wide unauthenticated RCE to authenticated/LAN-side RCE. Net: a genuinely serious device-takeover bug on an affected router, but priority is bounded by a niche/older consumer product, no exploitation telemetry, and unverified pre-auth reachability.
Exploit ScenarioDerived	An attacker with network reachability to the TOTOLINK N150RT web management interface sends a crafted POST request to /boafrm/formPortFw with overly long ip_subnet and/or fw_ip parameters while adding a port-forwarding rule, smashing the stack and hijacking control flow to run arbitrary code on the router. A public PoC/writeup (H3rmesk1t gist) exists, lowering the barrier to reproduction. Realistic reach is strongest from the LAN or an exposed management interface; internet-wide unauthenticated exploitation depends on whether the endpoint is reachable pre-authentication, which is not confirmed.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 30, 2026

Stack-based buffer overflow in the TOTOLINK N150RT (NTR150) web management interface, firmware V3.4.0-B20201030, allows a remote attacker to corrupt memory and potentially gain code execution by sending oversized ip_subnet and fw_ip parameters to the /boafrm/formPortFw port-forwarding handler during the rule-addition flow. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), modeling an unauthenticated, low-complexity attack with full confidentiality, integrity and availability impact, although port-forwarding configuration is normally an admin-authenticated function and the PR:N assertion should be confirmed against the published proof-of-concept material before relying on it. No CISA KEV entry or confirmed public exploit was identified at time of analysis, and realistic exposure is primarily LAN-side unless the management interface has been deliberately exposed to the WAN or internet.

RemediationAI

No vendor-released patch was identified at time of analysis, and given the age of firmware V3.4.0-B20201030 and TOTOLINK's limited security-maintenance history for this model, users should not assume a fix is imminent; check the TOTOLINK support/download page and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-94952) for a newer firmware build before applying anything. Until a fix exists, apply compensating controls in order of effectiveness: first, ensure the web management interface is never reachable from the WAN - disable remote management, verify the device is not in a DMZ and that no port-forward rule exposes TCP/80 or the admin port, accepting that this breaks any legitimate remote-administration workflow; second, if the device supports it, restrict the management interface to a specific trusted LAN segment or source IP, and place the router's LAN behind a segmented VLAN so a compromise cannot pivot to other hosts; third, replace the router with a supported model if WAN-side management is operationally required, since the only reliable fix for an unpatched authenticated-form overflow is removal of the vulnerable component. Additionally, rotate any credentials stored on or administered through the device, and monitor the router for unexpected reboots or configuration changes, which are the most likely observable signs of exploitation of this overflow. Because the PR:N claim is unverified, treat an exposed /boafrm/formPortFw endpoint as the critical variable: if it is reachable without an admin session, the 9.8 rating applies as written and exposure should be treated as urgent.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is a classic CWE-121 stack-based buffer overflow in the HTTP request-parsing path of the router's embedded Boa-style web server. The /boafrm/formPortFw endpoint processes form submissions for port-forwarding rules, copying the attacker-controlled ip_subnet and fw_ip parameters into fixed-size stack buffers without adequate length validation, so an overlong value overwrites adjacent stack memory including saved control data. Because the overwritten region can influence the return address, the primitive is a memory-corruption issue that may yield denial of service (device crash/reboot) and, depending on architecture mitigations such as ASLR/NX on the MIPS/ARM firmware image, a path to arbitrary code execution under the web server's privileges - typically root on consumer routers. The supplied CPE string is a placeholder (cpe:2.3:a:n/a:n/a), so identification rests on the firmware name and version V3.4.0-B20201030 rather than an authoritative CPE; the same issue is tracked in the EU with ENISA EUVD ID EUVD-2026-89470.

Know when TOTOLINK gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Retained PR:N to match the reported pre-auth reachability of the boa endpoint; network-reachable low-complexity stack overflow yields full code-execution impact (C/I/A:H), though PR:N is uncertain for a config handler.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 30, 2026 - 17:22 NVD

9.8 (CRITICAL)

CVE Published

Sep 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 29, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw (port-forwarding configuration handler) and is triggered by the ip_subnet and fw_ip request parameters during the rule-addition flow.

Executive ViewAI

Why It Matters

The TOTOLINK N150RT router (firmware V3.4.0-B20201030) is affected by a critical stack-based buffer overflow in its web management interface, potentially enabling remote code execution. Organizations using this device face network compromise risk, particularly if the management interface is exposed beyond the LAN; leadership should act promptly given the absence of a vendor patch and the critical severity (CVSS 9.8). No public exploit identified at time of analysis, but the vulnerability is unauthenticated per the CVSS vector (PR:N), though port-forwarding is typically admin-authenticated and this should be verified.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include ensuring the management interface is not exposed to the internet, restricting access to trusted LAN segments, disabling remote management if not needed, monitoring for anomalous requests to /boafrm/formPortFw, and deploying network segmentation. Consider replacing the device if risk tolerance is low.

Threat Intelligence Overview

EPSS Score

0.3%

Top 80% exploitable

Prevalence

Low

budget SOHO router, older low-end TOTOLINK model, consumer/niche footprint

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.