Stack-Based Buffer Overflow in TOTOLINK N150RT Firmware

Executive Summary

CVE-2026-94953 is a stack-based buffer overflow in the TOTOLINK N150RT router firmware V3.4.0-B20201030. It occurs in the web management interface at the /boafrm/formAjaxSet endpoint when the topicurl parameter is set to setting/setWiFiRepeaterConfig. The vulnerability is triggered by an unbounded strcpy() operation copying the ApCliWEPKey field into a 68-byte stack buffer without input validation. If ApCliWEPKey exceeds 67 bytes, it overflows, crashing the boa web server running as root.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your TOTOLINK N150RT router is running firmware version V3.4.0-B20201030. Test the vulnerable endpoint by sending a crafted request to /boafrm/formAjaxSet with topicurl=setting/setWiFiRepeaterConfig and a long ApCliWEPKey value. Monitor for crashes in the boa web server process.

• Use curl to send a test payload: curl -X POST 'http://<router-ip>/boafrm/formAjaxSet' -d 'topicurl=setting/setWiFiRepeaterConfig&ApCliAuthMode=WEP&ApCliKeyFormat=0&ApCliWEPKey=<3000-byte-string>'

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to crash the router's web server by sending a maliciously crafted request. Since the boa server runs with root privileges, the crash could lead to denial of service (DoS) or potentially remote code execution (RCE) if the overflow overwrites critical stack data. Exploitation requires authentication to access the vulnerable endpoint.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the router firmware to a patched version if available. Disable remote management access to the web interface if not required. Implement network segmentation to limit exposure of the vulnerable device. Monitor for unusual traffic patterns or crashes in the web server.

Useful 0 Not Useful 0