CVE-2026-100896: TOTOLINK N150RT RCE Vulnerability

CVE-2026-100896 Overview

CVE-2026-100896 is an operating system command injection vulnerability in the TOTOLINK N150RT router running firmware version 3.4.0-B20201030. The flaw resides in the system function within /boafrm/formWlSiteSurvey, part of the Web Management Interface. Attackers can manipulate the wlanif argument to inject arbitrary operating system commands. Remote exploitation is possible over the network, and a public proof-of-concept has been released.

Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on the router with the privileges of the web server process, enabling full device compromise and pivot into the internal network.

Affected Products

TOTOLINK N150RT router
Firmware version 3.4.0-B20201030
Web Management Interface component (/boafrm/formWlSiteSurvey)

Discovery Timeline

2026-09-28 - CVE-2026-100896 published to the National Vulnerability Database
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100896

Vulnerability Analysis

The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. The TOTOLINK N150RT web interface exposes the formWlSiteSurvey handler, which accepts a wlanif parameter used to specify the wireless interface for a site survey operation. The handler passes this parameter directly into a system() call without sanitization or validation.

An attacker who can reach the Web Management Interface and submit a crafted request to /boafrm/formWlSiteSurvey can append shell metacharacters to the wlanif argument. The injected commands execute in the context of the web server, which typically runs as root on consumer router firmware. Successful exploitation yields complete control of the device.

Root Cause

The root cause is the use of an unsanitized user-supplied HTTP parameter in a command string passed to a shell interpreter. The firmware concatenates the wlanif value into a shell command rather than invoking the target binary directly with argument arrays or escaping metacharacters. This pattern is common in embedded Boa web servers that proxy requests to CGI-like handlers.

Attack Vector

Exploitation requires network access to the router's management interface and low-privilege credentials. The attacker sends an HTTP POST request to /boafrm/formWlSiteSurvey with a malicious wlanif value containing shell separators such as ;, |, or backticks followed by arbitrary commands. A public proof-of-concept is available via a GitHub Gist PoC. Additional analysis is documented in the VulDB CVE Details entry.

No verified code examples are available. Refer to the published proof-of-concept for the exact request structure.

Detection Methods for CVE-2026-100896

Indicators of Compromise

HTTP requests to /boafrm/formWlSiteSurvey containing shell metacharacters (;, |, &, backticks, $()) within the wlanif parameter.
Unexpected outbound connections initiated by the router, including reverse shells or DNS exfiltration from the device management plane.
New or modified processes on the router such as telnetd, nc, wget, or tftp invoked from the Boa web server context.
Unauthorized configuration changes, firmware modifications, or new accounts on the Web Management Interface.

Detection Strategies

Inspect HTTP traffic to the router's management interface for request bodies containing command separators in the wlanif field.
Correlate authentication events on the web interface with subsequent anomalous outbound traffic from the router.
Deploy network-based intrusion detection signatures for the TOTOLINK formWlSiteSurvey URI combined with shell metacharacters.

Monitoring Recommendations

Log and alert on all administrative access to router web interfaces, especially from non-management network segments.
Monitor DNS and NetFlow telemetry for routers initiating connections to untrusted external hosts.
Review router system logs for abnormal process execution or crash events in the web server component.

How to Mitigate CVE-2026-100896

Immediate Actions Required

Restrict access to the Web Management Interface to trusted management VLANs or specific administrator IP addresses.
Disable remote WAN-side administration if it is enabled on the device.
Change default and weak administrator credentials to reduce the attack surface for authenticated exploitation.
Isolate affected N150RT devices from sensitive network segments until a vendor patch is applied.

Patch Information

At the time of publication, no vendor patch has been identified in the available references. Monitor the Totolink Official Site for firmware updates addressing CVE-2026-100896 and consult the VulDB Vulnerability Info entry for status changes.

Workarounds

Block external access to the router management interface at the network perimeter.
Place the router behind a segmentation firewall and allow management only from a jump host.
Replace end-of-life or unpatched consumer routers with vendor-supported hardware if no fix becomes available.
Deploy web application firewall rules that drop requests to /boafrm/formWlSiteSurvey containing shell metacharacters.

bash

# Example iptables rule restricting router web management to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP