CVE-2026-94953 Details
Description
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formAjaxSet using the topicurl=setting/setWiFiRepeaterConfig branch and the ApCliWEPKey field.
A stack-based buffer overflow vulnerability has been identified in the web management interface of the TOTOLINK N150RT (NTR150) router, specifically in firmware version V3.4.0-B20201030. The vulnerability arises in the JSON-API configuration endpoint '/boafrm/formAjaxSet', when the 'topicurl' is set to 'setting/setWiFiRepeaterConfig' and the 'ApCliWEPKey' field is populated with a WEP key longer than 67 bytes. This unbounded input is copied into a fixed 68-byte stack buffer using 'strcpy()', leading to a buffer overflow.
To address this vulnerability, it is recommended to implement length validation for the 'ApCliWEPKey' and 'ApCliWPAPSK' fields before any string operations. Additionally, enforcing JSON field length limits at the read layer for all wireless configuration fields would help prevent such vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 29, 2026CISA-ADP
Assessed Sep 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/H3rmesk1t/039c2c968fd535cfffecdf9626e963e2 | [email protected] | ExploitTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| TOTOLINK N150RT | V3.4.0-B20201030 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 30, 2026 | CVE Modified | CISA-ADP |
| Sep 29, 2026 | New CVE Received | [email protected] |