CVE-2026-94954 Details

A stack-based buffer overflow vulnerability has been identified in the web management interface of the TOTOLINK N150RT (NTR150) router, specifically in firmware version V3.4.0-B20201030. The vulnerability is accessible through the '/boafrm/formFilter' route, which handles access-control and URL filter configurations. It is triggered by the 'url' request parameter when the 'addFilterUrl' or 'addFilterUrlFlag' action flag is activated. The issue arises because the 'url' parameter is copied into a fixed 36-byte stack buffer using an unbounded 'strcpy()' function, without any length validation, allowing for overflow into adjacent stack data.

To address this vulnerability, the 'strcpy()' function should be replaced with 'snprintf()' to ensure proper length validation before copying data into the stack buffer. Additionally, URL-filter entries should be limited to a reasonable length and restricted to printable URL characters. An audit of other similar handlers in this SDK generation is also recommended.