Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

TOTOLINK N150RT web UI can be crashed via port‑forwarding

CVE-2026-94952 · published 19 days ago
Summary

The web management page of TOTOLINK N150RT routers running firmware version V3.4.0‑B20201030 can overflow its memory when handling certain port‑forwarding inputs. An attacker who can reach the router’s admin interface could cause it to stop working or potentially run unwanted code. Update the router firmware to a newer version or restrict access to the management interface to trusted users.

Original advisory text
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw (port-...
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw (port-forwarding configuration handler) and is triggered by the ip_subnet and fw_ip request parameters during the rule-addition flow.
References
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published29 Sep 2026
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-94952 · NVD
CVE-2026-94952 · MITRE
Track software like this
Free during beta