CVE-2026-100896

Name of the Vulnerable Software and Affected Versions TOTOLINK N150RT version 3.4.0-B20201030

Description The Web Management Interface contains a flaw in the /boafrm/formWlSiteSurvey endpoint. Specifically, the system() function fails to properly sanitize the wlanif argument, allowing a remote attacker to perform OS command injection. OS command injection is a technique where an attacker executes arbitrary operating system commands on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /boafrm/formWlSiteSurvey endpoint to minimize the risk of exploitation.