CVE-2026-94954

Deferred Deferred - Pending Action

Stack-Based Buffer Overflow in TOTOLINK N150RT Firmware

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: MITRE

Description

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formFilter (access-control / URL filter configuration handler) and is triggered by the url request parameter when the addFilterUrl (or addFilterUrlFlag) action flag is set.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94954

EUVD

EUVD-2026-89331

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	n150rt	3.4.0-b20201030

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

CVE-2026-94954 is a stack-based buffer overflow in the TOTOLINK N150RT firmware's web management interface. It occurs in the /boafrm/formFilter component when adding URL-filter rules. The vulnerability is triggered by a long URL parameter passed via a POST request with specific action flags (addFilterUrl or addFilterUrlFlag). The issue stems from using an unbounded strcpy() to copy the URL into a fixed 36-byte stack buffer without length validation.

Detection Guidance

To detect this vulnerability, monitor for crashes in the boa web server process after sending a POST request with a long url parameter to /boafrm/formFilter. Check logs for segmentation faults or unusual traffic patterns targeting this endpoint.

Impact Analysis

This vulnerability can allow an authenticated attacker to crash the boa web server process (denial of service) or potentially execute arbitrary code with root privileges. Exploitation requires sending a POST request to /boafrm/formFilter with a long url parameter and specific action flags. The lack of stack canaries and ASLR in the firmware increases the risk of remote code execution.

Compliance Impact

This vulnerability could lead to unauthorized remote code execution with root privileges, potentially exposing sensitive data processed or stored by the device. Such a breach may violate GDPR's data protection requirements and HIPAA's security rules for protected health information if the device handles such data.

Mitigation Strategies

Immediately restrict access to the web management interface. Update the firmware to a patched version if available. As a temporary fix, implement input validation to limit the url parameter length to 35 bytes or replace strcpy() with a bounded function like snprintf().

Hi! I’m here to help you understand CVE-2026-94954. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70