CVE-2026-94953 in N150RT
Summary
by MITRE • 09/29/2026
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formAjaxSet using the topicurl=setting/setWiFiRepeaterConfig branch and the ApCliWEPKey field.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in TOTOLINK N150RT firmware version V3.4.0-B20201030 represents a critical security flaw within the device's web management interface, specifically classified as a stack-based buffer overflow. This type of memory corruption error occurs when data is written to a fixed-size block on the call stack without adequate bounds checking, allowing an attacker to overwrite adjacent memory locations including return addresses and function pointers. The specific attack vector targets the endpoint /boafrm/formAjaxSet, which serves as the backend handler for AJAX requests within the router's administrative console. By manipulating the topicurl parameter set to setting/setWiFiRepeaterConfig, an adversary can interact with the WiFi repeater configuration module, a feature often used in home and small office networks to extend wireless coverage but frequently overlooked by users regarding its security implications.
The core technical flaw resides in the handling of the ApCliWEPKey field during the processing of these AJAX requests. WEP keys are legacy encryption parameters that require specific formatting and length constraints when processed by embedded systems. In this firmware version, the application fails to validate the length or content of the input provided for the ApCliWepKey parameter before copying it into a fixed-size buffer on the stack. This lack of rigorous input validation allows an attacker to supply a payload significantly larger than the allocated memory space. When the function processes this oversized input, the excess data spills over into adjacent memory regions on the stack, corrupting critical control flow information such as the saved instruction pointer and frame pointers.
From an operational perspective, the impact of this vulnerability is severe due to its potential for remote code execution without authentication in many default configurations or if administrative credentials are weak or known. Stack-based buffer overflows typically allow attackers to redirect program execution to arbitrary shellcode injected into the overflowed memory region. In the context of a network router, successful exploitation grants full control over the device's operating system and firmware environment. This compromises not only the integrity of the specific device but also the entire local area network it protects. Attackers can intercept unencrypted traffic, perform man-in-the-middle attacks, redirect DNS queries to malicious servers for phishing or malware distribution, and use the compromised router as a pivot point to launch further attacks against internal assets. Furthermore, persistent backdoors installed via this method ensure long-term unauthorized access even after reboots if persistence mechanisms are exploited alongside the overflow.
This vulnerability aligns with CWE-121, which defines stack-based buffer overflows resulting from unsafe memory operations where bounds checking is omitted or incorrectly implemented. It also maps to MITRE ATT&CK technique T1059, specifically command and script interpretation through local execution, as well as potential lateral movement vectors if the router serves as a gateway for internal network segmentation bypasses. The exploitation path highlights common weaknesses in embedded web interfaces where complex form handling logic often lacks robust sanitization routines compared to enterprise-grade applications.
Mitigation strategies must prioritize immediate firmware updates provided by TOTOLINK that address this specific buffer overflow issue through proper input validation and bounds checking on the ApCliWEPKey field. In environments where patching is not immediately feasible, network segmentation should be enforced to isolate management interfaces from general user traffic, ensuring that administrative ports are accessible only from trusted IP addresses via firewall rules. Additionally, disabling unnecessary features such as WiFi repeater configuration if they are not actively used reduces the attack surface available to potential adversaries. Regular auditing of router configurations and enforcing strong, unique passwords for administrative access further mitigates the risk of exploitation by limiting opportunities for unauthorized interaction with vulnerable endpoints.