CVE-2026-94952 in N150RT
Summary
by MITRE • 09/30/2026
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw (port-forwarding configuration handler) and is triggered by the ip_subnet and fw_ip request parameters during the rule-addition flow.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in TOTOLINK N150RT firmware version V3.4.0-B20201030 represents a critical security flaw within the device's web-based management interface, specifically located at the network address /boafrm/formPortFw. This endpoint serves as the handler for port-forwarding configuration requests, allowing administrators to define rules that map external ports to internal IP addresses and services. The core of this vulnerability is a stack-based buffer overflow triggered by improper validation or bounds checking when processing two specific request parameters: ip_subnet and fw_ip. These parameters are integral to defining the destination network and host for forwarded traffic, respectively. When an attacker crafts a malicious HTTP POST request containing excessively long strings in these fields, the application fails to adequately restrict the input length before copying it into fixed-size stack buffers. This lack of boundary enforcement allows data to spill beyond the allocated memory space on the call stack, overwriting adjacent memory locations that may contain critical control flow information such as return addresses or function pointers.
From a technical perspective, this flaw aligns with Common Weakness Enumeration (CWE) category CWE-121, which describes a stack-based buffer overflow resulting from writing data beyond the bounds of a fixed-size buffer on the call stack. The mechanism relies on the predictable layout of the stack in many embedded systems and older firmware implementations. By carefully crafting the payload to include shellcode or specific instruction sequences followed by an overwritten return address pointing to that code, an attacker can achieve arbitrary code execution within the context of the web server process running on the router. This is particularly dangerous because network management interfaces often run with elevated privileges relative to standard user applications, and in many embedded devices, these services may operate as root or have access to sensitive system configurations. The vulnerability is remotely exploitable without authentication if the device's administrative interface does not enforce strict access controls for this specific endpoint, although even authenticated attackers could leverage it to escalate their privilege level or pivot within a local network segment.
The operational impact of successfully exploiting this stack-based buffer overflow extends far beyond simple service disruption. An attacker who gains code execution on the router can effectively compromise the entire perimeter security posture of the connected network. This includes the ability to intercept, modify, or drop traffic passing through the device, perform man-in-the-middle attacks against internal hosts, and exfiltrate sensitive data traversing the network. Furthermore, compromised routers are frequently used as nodes in botnets for distributed denial-of-service (DDoS) attacks, cryptomining operations, or further lateral movement into more secure corporate or home networks. The persistence of such malware on an embedded device is often high because these devices rarely undergo regular patch cycles once deployed, leaving them vulnerable to exploitation long after the vendor has released a fix. This scenario maps directly to MITRE ATT&CK techniques related to initial access and privilege escalation, specifically leveraging software vulnerabilities for remote code execution (T1190) and potentially command and control setup via compromised infrastructure.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary defense is the application of vendor-provided firmware updates that patch this specific buffer overflow by implementing proper input validation, length checks, or using safer string handling functions that prevent stack corruption. Administrators should ensure their TOTOLINK N150RT devices are updated to a version where /boafrm/formPortFw correctly sanitizes ip_subnet and fw_ip inputs before processing them into the underlying C structures. In environments where immediate patching is not feasible, network-level mitigations can be employed. This includes placing the router behind an intrusion prevention system (IPS) configured with signatures capable of detecting buffer overflow attempts in HTTP POST bodies, particularly those targeting known vulnerable endpoints like formPortFw. Additionally, restricting access to the web management interface by IP address or VLAN segmentation reduces the attack surface significantly. Enabling strong authentication mechanisms and disabling unnecessary services further hardens the device against exploitation attempts that rely on direct interaction with the vulnerable handler.