EUVD-2026-88060
GHSA-h89x-j3xw-6xgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach web management interface
-
DeliveryAuthenticate (valid or default creds)
-
ExploitPOST crafted wlanif to /boafrm/formWlSiteSurvey
-
ExecutionShell command injected into system() call
-
PersistExecute arbitrary commands as root
-
ImpactFull router compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the TOTOLINK N150RT (firmware 3.4.0-B20201030) Web Management Interface and at least low-privilege authentication (PR:L) - typically valid or default/weak router credentials. The attacker sends a request to /boafrm/formWlSiteSurvey with a malicious 'wlanif' argument that is injected into an OS system() call. Limiting factors: the web management interface is normally LAN-facing, so WAN exploitation depends on remote administration being enabled; authentication is required, though SOHO routers commonly ship with weak or default credentials that undermine this barrier. |
| Impact | This is a genuine but privilege-gated OS command injection (CWE-78) in the TOTOLINK N150RT SOHO router firmware. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC/VI/VA:H and SC/SI/SA:H, score 8.6) indicates network-reachable, low-complexity exploitation that requires some level of authentication (PR:L). A public exploit exists (VulDB-referenced GitHub gist), which raises practical risk beyond theory. However, exploitation status is 'publicly available exploit code exists' - this is distinct from active exploitation: there is no CISA KEV listing and no EPSS score was provided, so widespread automated exploitation is not confirmed. The PR:L requirement is the key mitigating factor: an attacker needs valid credentials (or, realistically on consumer routers, default/weak credentials) and reachability to the web management interface, which is typically LAN-facing unless remote administration is enabled. The vendor asserts a scope change (SC/SI/SA:H); in practice the injected command runs on the router's own OS (usually as root), so whether this is a true scope change is arguable - I model it as same-scope with full C/I/A impact. Net: a real, actionable flaw with a working PoC, but its real-world reach is bounded by authentication and typical LAN-only exposure rather than being an unauthenticated internet-wide risk. |
| Exploit ScenarioDerived | An attacker with access to the router's web management interface (via the LAN, or the WAN if remote management is enabled) and valid or default credentials sends a crafted request to /boafrm/formWlSiteSurvey with a malicious wlanif parameter, which is passed unsanitized into a system() call. The injected shell command executes on the router OS (typically as root), yielding full device takeover. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 28, 2026
OS command injection in the TOTOLINK N150RT SOHO router (firmware 3.4.0-B20201030) lets an attacker who can reach the Web Management Interface and has at least low-privilege credentials execute arbitrary operating-system commands on the device. The flaw is reachable through the /boafrm/formWlSiteSurvey handler, where the 'wlanif' argument is passed unsanitized into a shell command, giving full compromise of confidentiality, integrity and availability (CVSS 4.0 base 8.6; independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists (a reference gist is tagged as an exploit), meaning the technique is already in circulation, but the issue is not confirmed actively exploited (no CISA KEV entry) and it is privilege-gated: the router web interface is normally LAN-facing, so WAN reachability depends on remote administration being enabled.
Earlier versions of this analysis (1)
OS command injection in the TOTOLINK N150RT wireless router (firmware 3.4.0-B20201030) allows an attacker who can reach the Web Management Interface to execute arbitrary shell commands by supplying a crafted 'wlanif' argument to the /boafrm/formWlSiteSurvey handler. The CVSS v4.0 vector (PR:L) indicates the attacker needs at least low-privilege authenticated access to the web interface, and exploitation is remote with no user interaction; a publicly available proof-of-concept exploit exists (publicly available exploit code exists). With an assessed CVSS 3.1 base of 8.8 (High) and high confidentiality, integrity, and availability impact, this is a genuine high-priority issue for the affected device class, though practical exposure is usually limited to devices whose management interface is reachable from the attacking network (LAN by default, WAN only if remote management is enabled).
RemediationAI
No vendor-released patch is identified in the provided references, so owners of the TOTOLINK N150RT (3.4.0-B20201030 and likely other builds) should first check TOTOLINK's site (https://www.totolink.net/) and the VulDB advisory (https://vuldb.com/vuln/410846, CTI view at https://vuldb.com/vuln/410846/cti) for a firmware update; if one appears, upgrade to the newest firmware and re-verify that /boafrm/formWlSiteSurvey still exists. Until a fix is available, the most effective compensating control is to disable remote/WAN administration (and UPnP port mapping or any port-forward to the router web UI) so the management interface is reachable only from the trusted LAN - this trades off the convenience of managing the router from outside the network. Change default and weak administrator credentials and enforce a strong unique password, since the attack requires only low-privilege authenticated access. Further harden by restricting management access to specific administrative hosts where the firmware permits, disabling unused services (site survey / WLAN diagnostics features if they can be turned off), and isolating the router on a dedicated management VLAN or segment. Because public exploit code exists (see https://gist.github.com/H3rmesk1t/c071a62375f38b629f67653428a8f25a), monitor router logs and outbound connections for unexpected shell activity or reverse shells from the device, and consider replacing the N150RT with a supported model if TOTOLINK does not ship a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a classic command-injection class in which user-controlled input is concatenated into a string executed by a system()/shell call without escaping. Here the vulnerable component is the BOA-based web management interface of the TOTOLINK N150RT: the endpoint /boafrm/formWlSiteSurvey takes a 'wlanif' argument (typically the wireless interface name used for a site-survey operation) and feeds it into an OS command, so shell metacharacters in that parameter allow arbitrary commands to be appended and executed with the privileges of the web server process (usually root on embedded router firmware). CPE data identifies the affected platform as cpe:2.3:a:totolink:n150rt:*:*:*:*:*:*:*:*, i.e. the N150RT product line as a whole, with the report tied to version 3.4.0-B20201030. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, high impacts across VC/VI/VA and the subsequent-system metrics) matches the independent assessment's view that exploitation is network-reachable but requires low-privilege authentication; no user interaction is needed and no special attack conditions (AT:N) are required beyond authenticated HTTP access to the management interface.
Know when N150Rt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable web interface with low-privilege auth (PR:L) and low complexity; unsanitized argument yields root command execution with full C/I/A on the same device, so S:U.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Technical POC Analysis
CWE-78 OS command injection in the web management daemon /bin/boa, handler sub43C5F8 at 0x43C5F8, reached via the route /boafrm/formWlSiteSurvey (the wireless site-survey / "connect to selected AP" f…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The TOTOLINK N150RT SOHO router, firmware 3.4.0-B20201030, contains an OS command injection flaw that allows an authenticated attacker with network access to fully compromise the device. This could enable attackers to intercept or manipulate network traffic, pivot into internal networks, or disrupt connectivity for affected offices or remote workers. Leadership should prioritize mitigation because publicly available exploit code increases the likelihood of attempted exploitation and no vendor-released patch was identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable remote administration, restrict web management interface to trusted LAN only, enforce strong unique credentials, segment routers on isolated VLANs, monitor for suspicious commands, and consider replacing affected devices with supported models.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB