Vulnerability · Published Sep 28, 2026 · Assigned by VulDB

CVE-2026-100896TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection

Critical 9.9

In plain English

A critical-severity OS command injection in N150RT from TOTOLINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)1.9%top 20.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
TOTOLINK	N150RT	3.4.0-B20201030

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-410846 | TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection vdb-entry, technical-description
VDB-410846 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-100896 | CVE Analysis and Report third-party-advisory
Submit #918574 | TOTOLINK N150RT V3.4.0-B20201030 Command Injection third-party-advisory
https://gist.github.com/H3rmesk1t/c071a62375f38b629f67653428a8f25a exploit
https://www.totolink.net/ product