CVE-2026-100896: TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection
A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack is remotely exploitable over the network and requires low privileges. No user interaction is required.
Which deployments are known to be affected?
The affected product and version identified are TOTOLINK N150RT 3.4.0-B20201030. The issue is in the Web Management Interface endpoint /boafrm/formWlSiteSurvey.
Is exploit code available?
Yes. Public exploit material is available, which increases the likelihood that the issue could be used in attacks.