EUVD-2026-89331
GHSA-jmg7-x5hr-mqcm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI (PR:L)
-
DeliveryPOST crafted request to /boafrm/formFilter with addFilterUrl flag
-
ExploitOverflow stack buffer via oversized url parameter
-
ExecutionOverwrite return address
-
PersistExecute arbitrary code on device
-
ImpactFull device takeover (C:H/I:H/A:H)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated low-privilege access (PR:L) to the TOTOLINK N150RT (NTR150) web management interface on firmware V3.4.0-B20201030, and the request must target the /boafrm/formFilter access-control/URL-filter handler with the addFilterUrl (or addFilterUrlFlag) action flag set and an oversized url parameter. Limiting factors: valid credentials or session are needed (not fully unauthenticated), the flaw is specific to this model and firmware build, and practical reach depends on whether the management interface is exposed to the attacker's network - default consumer deployments typically expose it only on the LAN, so WAN-side exploitation requires remote management to be enabled or an attacker already on the local network. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity stack overflow requiring low-privilege authentication, yielding total compromise of the device. SSVC tempers this: Exploitation is rated 'none' (no observed active exploitation), Automatable 'no' (the authentication gate and per-device nature prevent spray-and-pray mass exploitation), but Technical Impact is 'total' - consistent with full code execution on the router. Publicly available exploit code exists (a H3rmesk1t gist is referenced), which raises practical exploitability above a theoretical bug, but there is no CISA KEV listing and no EPSS score provided, signaling no evidence of widespread or active exploitation yet. Net: this is a credible, POC-backed RCE on a specific consumer router, but real-world priority is bounded by the authentication requirement, the narrow/obsolete affected firmware (V3.4.0-B20201030), and low deployment footprint - a serious issue for exposed TOTOLINK N150RT units but not an internet-wide emergency. Note the CPE string is a placeholder ('cpe:2.3:a:n/a:n/a:*') and EUVD affected version lists 'n/a n/a', so machine-readable product/version data is effectively missing and must be read from the human description. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the TOTOLINK N150RT web management interface (e.g. a logged-in user, default/guessed credentials, or an exposed admin panel) sends a crafted POST to /boafrm/formFilter with the addFilterUrl (or addFilterUrlFlag) action flag set and an oversized url parameter, overflowing a stack buffer in the URL-filter configuration handler. This overwrites the return address and leads to arbitrary code execution on the router. A public proof-of-concept gist exists, lowering the effort to reproduce; the low attack complexity (AC:L) means no special timing or race conditions are needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030 contains a stack-based buffer overflow in the web management handler /boafrm/formFilter that is triggered when an oversized url parameter is submitted with the addFilterUrl (or addFilterUrlFlag) action flag set, allowing an attacker who can reach the interface to corrupt stack memory and gain full control of the device (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Exploitation is network-reachable and low-complexity but requires low-privilege authenticated access, so the realistic exposure is limited to management interfaces reachable on the LAN or to deployments where WAN-side remote administration has been enabled. No public exploit identified at time of analysis, no CISA KEV entry is present, and SSVC records Exploitation: none with Technical Impact: total; a third-party gist reference is linked but is not confirmed as weaponized exploit code.
RemediationAI
No vendor-released patch identified at time of analysis, and no TOTOLINK advisory is referenced in the available data, so the primary action is to check TOTOLINK's support channels for a firmware update for the N150RT/NTR150 that supersedes V3.4.0-B20201030 and apply it as soon as it appears; until then, treat the device as compromised-capable. Practical compensating controls, in order of effectiveness: disable WAN-side remote management and block inbound access to the administrative TCP ports (typically 80/443 and any custom admin port) at the perimeter firewall so the /boafrm/formFilter handler is reachable only from the LAN, accepting that this removes legitimate remote administration; if the URL filter/access-control feature is not required, avoid that configuration page entirely or disable the URL filter function, which removes the need to invoke the vulnerable handler while necessarily eliminating content-filtering capability; change default and shared admin credentials and reduce the number of accounts with access to the web UI, since exploitation requires low-privilege authentication (PR:L) - this raises the bar but does not eliminate the flaw for insiders or anyone with valid credentials; and segment the router onto an isolated management VLAN so a foothold elsewhere on the network cannot reach the interface. Monitoring the linked references (NVD record for CVE-2026-94954 and the gist at https://gist.github.com/H3rmesk1t/9e4bc190ee8130a3df5863c1c047766b) is advisable, since the gist may provide exploitation detail that informs detection; if a firmware patch still is not available, replacing the device with a supported model is the only control that fully removes the exposure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-121 stack-based buffer overflow in an embedded router CGI/web handler. The path prefix /boafrm/ indicates a Boa-derived embedded HTTP daemon, where form submissions are dispatched to per-function handlers; formFilter implements the access-control / URL filter configuration page, and the addFilterUrl (or addFilterUrlFlag) action flag distinguishes an add-url operation. In that code path the attacker-supplied url request parameter is copied into a fixed-size stack buffer without adequate length validation, so an oversized value overwrites adjacent stack memory and, on a typical MIPS consumer-router build lacking robust stack protections, can hijack control flow and yield code execution as the web server process. The CVSS vector confirms the network attack vector, low attack complexity, no user interaction, and total confidentiality/integrity/availability impact, with the only friction being PR:L (authenticated low-privilege access to the management UI). Product identification is complicated by an unmapped CPE entry (cpe:2.3:a:n/a:n/a) and an EUVD affected-version listing of "n/a n/a"; the authoritative scope therefore rests on the description naming TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030 and on ENISA EUVD-2026-89331. SSVC additionally marks the issue as not automatable and Exploitation: none, which is consistent with a targeted, credential-gated request rather than mass-scanning activity.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Web interface is network-reachable (AV:N) with a trivial oversized-parameter trigger (AC:L); a login is required (PR:L), and stack-overflow code execution on the router yields full C/I/A.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formFilter (access-control / URL filter configuration handler) and is triggered by the url request parameter when the addFilterUrl (or addFilterUrlFlag) action flag is set.
Executive ViewAI
The TOTOLINK N150RT (NTR150) wireless router running firmware V3.4.0-B20201030 contains a high-severity memory corruption flaw in its web management interface that lets an attacker with valid low-privilege credentials take full control of the device. Because the flaw is reachable over the network, any deployment where these routers sit on an untrusted segment - or where remote administration has been enabled from the internet - could allow an intruder to seize the device and use it as a foothold into the internal network. Leadership should care because these devices are typically unmanaged, rarely updated, and often positioned at the edge of small office, branch, and remote-worker environments where a single compromised unit can expose the wider corporate network.
No vendor-released patch is identified at time of analysis. Interim mitigations: disable WAN-side remote administration and block internet exposure of the web management interface; restrict management access to a trusted administrative VLAN or management subnet via network ACLs and firewall rules; replace default and shared administrator credentials with strong, unique passwords and enforce least-privilege accounts; segment affected routers into an isolated network with no route to sensitive systems; monitor or block anomalous requests to /boafrm/formFilter and the addFilterUrl/addFilterUrlFlag actions at the network layer; and plan hardware replacement with a supported product if no firmware fix is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB