Remote Code Execution in TOTOLINK N150RT

TOTOLINK N150RT firmware version 3.4.0-B20201030 contains a critical command injection vulnerability (CVE-2026-100896) within its Web Management Interface. The flaw is located in the '/boafrm/formWlSiteSurvey' handler, which improperly sanitizes user-supplied input provided to the 'wlanif' argument. An unauthenticated remote attacker can leverage this vulnerability to inject and execute arbitrary system-level commands on the underlying device. Given that public exploit code is already available, the risk of active exploitation by threat actors is high. Defenders should ensure these devices are isolated from the public internet and monitored for suspicious HTTP POST requests directed at the identified handler.

Attack Chain

1. Attacker performs network reconnaissance to identify accessible TOTOLINK N150RT web management interfaces.
2. Attacker initiates an HTTP POST request to the target device endpoint: /boafrm/formWlSiteSurvey.
3. Attacker crafts a malicious payload containing shell metacharacters (e.g., ;, |, &&) within the 'wlanif' parameter.
4. The web server process parses the HTTP request and passes the tainted 'wlanif' argument to a system-level function call.
5. The underlying OS executes the injected command with the privileges of the web management service.
6. The attacker establishes a reverse shell or downloads secondary payloads to achieve persistent unauthorized access.

Impact

Successful exploitation allows for full system compromise, including unauthorized code execution, potential exfiltration of sensitive configuration data, and the ability to repurpose the device for further malicious activities within the local network.

Recommendation

1. Immediately restrict access to the Web Management Interface of TOTOLINK devices from the public internet.
2. Implement network-level monitoring to detect POST requests to '/boafrm/formWlSiteSurvey' containing shell metacharacters in the query parameters.
3. Update firmware to the latest available version if a patch is provided by the manufacturer, as version 3.4.0-B20201030 is confirmed vulnerable.