EUVD-2026-89364
GHSA-jjpm-47gv-3g9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to web management interface
-
DeliveryPOST to /boafrm/formAjaxSet setWiFiRepeaterConfig branch
-
ExploitOverflow stack buffer via oversized ApCliWEPKey
-
ExecutionHijack control flow on boa service
-
ImpactExecute code / crash router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the TOTOLINK N150RT (NTR150) web management interface running firmware V3.4.0-B20201030 and low-privilege authentication (PR:L) to that interface. The attacker must send a request to /boafrm/formAjaxSet selecting the topicurl=setting/setWiFiRepeaterConfig branch and supply an oversized ApCliWEPKey field to overflow the stack buffer. Limiting factors: the web admin interface is typically LAN-bound by default (internet exposure only if remote management is enabled), valid credentials are needed, and only the specified firmware build is confirmed affected. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity stack overflow requiring only low-privilege authentication, with total impact to confidentiality, integrity, and availability. A public gist (H3rmesk1t) is referenced, so publicly available exploit code exists, though this is distinct from active exploitation. SSVC counters the high base score: Exploitation=none (no observed in-the-wild activity), Automatable=no, Technical Impact=total - meaning high damage potential but not a mass-exploitable, wormable condition. There is no CISA KEV listing and no EPSS value supplied. Net assessment: a genuinely dangerous memory-corruption bug on an affected device, but real-world priority is tempered by the authentication requirement (PR:L), the typically small/consumer deployment footprint, and the absence of evidence of exploitation. Note the full C:H/I:H/A:H rating is optimistic for stack overflows in embedded TOTOLINK CGI handlers, which frequently manifest as crashes/DoS unless reliable code execution is demonstrated - the referenced PoC should be examined to confirm whether it achieves RCE or only a crash. CPE and EUVD version fields are populated with 'n/a' placeholders, limiting precise affected-scope confirmation beyond the single firmware build named in the description. |
| Exploit ScenarioDerived | An attacker with low-privilege credentials (or access to a device left on default/weak web-admin credentials) on the LAN or an exposed management interface sends a crafted POST to /boafrm/formAjaxSet with topicurl=setting/setWiFiRepeaterConfig and an oversized ApCliWEPKey value, overflowing a stack buffer. Depending on reliability, this crashes the boa web service (DoS) or hijacks control flow for arbitrary code execution on the router. Public exploit/PoC material is referenced in a GitHub gist, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Authenticated stack-based buffer overflow in the TOTOLINK N150RT (NTR150) web management interface (firmware V3.4.0-B20201030) allows a network-adjacent or remote attacker holding low-privilege credentials to crash or seize control of the device by posting an oversized ApCliWEPKey value to the /boafrm/formAjaxSet handler on the topicurl=setting/setWiFiRepeaterConfig branch. Successful exploitation yields total loss of confidentiality, integrity and availability on the router (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which in a home or small-office context means credential interception, DNS/traffic manipulation, and use of the device as a pivot. No public exploit has been identified at time of analysis, CISA SSVC records exploitation as 'none', and no vendor-released patch or fixed firmware version has been identified; exposure is largely gated by whether the administration interface is reachable (LAN-bound by default, internet-reachable only when remote management is enabled).
RemediationAI
No vendor-released patch or fixed firmware version has been identified at time of analysis, so the first action is to check TOTOLINK's official N150RT/NTR150 support and download pages for a build newer than V3.4.0-B20201030 and apply it immediately if one exists; if no update is published, treat the device as unpatchable and rely on compensating controls. Keep the web management interface off the WAN: verify that remote management / WAN-side administration is disabled and confirm from outside the network that the admin port is not reachable, accepting the trade-off that remote troubleshooting must then go through a VPN or an internal host. Restrict management to a trusted subnet with firewall/VLAN ACLs that permit only specific administrator IPs to reach the router's HTTP/HTTPS management port, and change any default or shared administrator credentials - because the exploit requires only low-privilege authentication (PR:L), reducing the number of accounts that can log in materially shrinks the attack surface. If repeater/AP-client (WISP) functionality is not in use, leave Wi-Fi repeater configuration unconfigured and, where the firmware permits, disable the feature so the vulnerable setting/setWiFiRepeaterConfig code path is not reachable; the cost is loss of Wi-Fi range extension. Place the N150RT on an isolated management VLAN or dedicated SSID with no trust relationship to client devices, since a successful overflow gives full control of the router (high C/I/A), and log/alert on POST bodies to /boafrm/formAjaxSet whose ApCliWEPKey value is anomalously long as an early-warning indicator. Because no KEV or public exploit is currently recorded, these measures are precautionary, but the low attack complexity and total technical impact make them worth applying before exploit code appears.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow (a child class of CWE-787, out-of-bounds write) in the embedded HTTP management daemon of the TOTOLINK N150RT. The /boafrm/formAjaxSet endpoint is part of the Boa-style form-handling layer used across TOTOLINK firmware: the request's topicurl parameter selects a server-side handler, and in this case routing to setting/setWiFiRepeaterConfig causes the value supplied in ApCliWEPKey - the WEP key configured for the AP-client (repeater/WISP) uplink interface - to be copied into a fixed-size stack buffer without a length check. WEP keys have a naturally small valid range, so the parser evidently never anticipates long input, and a sufficiently long ApCliWEPKey overwrites adjacent stack memory including saved registers and the return address, giving the attacker control of the instruction pointer on MIPS-class embedded hardware that typically lacks stack canaries, ASLR and NX in the same form as general-purpose platforms. The CVSS vector confirms the overflow is reachable over the network with low complexity, requires only low-privilege authentication (PR:L) to the web UI, needs no user interaction, and is scoped to the device (S:U) with high impact across all three security objectives once code execution or a hard crash occurs. Because the same firmware generation is used across several TOTOLINK router models, the identical /boafrm/ dispatch pattern may exist elsewhere, but only V3.4.0-B20201030 on the N150RT/NTR150 is confirmed here.
Know when TOTOLINK gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web endpoint, low complexity, requires low-privilege web-admin authentication (PR:L); stack overflow in router service plausibly yields full code execution, hence C/I/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formAjaxSet using the topicurl=setting/setWiFiRepeaterConfig branch and the ApCliWEPKey field.
Executive ViewAI
TOTOLINK N150RT routers running firmware V3.4.0-B20201030 contain a high-severity stack-based buffer overflow that allows an authenticated attacker with low-privilege credentials to crash or completely compromise the device. This affects home and small-office networks, potentially enabling credential interception, DNS manipulation, and use of the router as a pivot point into other systems. Leadership should prioritize remediation because a compromised router undermines the confidentiality, integrity, and availability of all network traffic and connected devices.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management interface to LAN only, disable remote management, enforce strong credentials, network segmentation, monitor for unusual traffic, consider device replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Exploit-DB