A vulnerability exists in the TOTOLINK N150RT router firmware 3.4.0-B20201030, where the web‑management interface endpoint /boafrm/formWlSiteSurvey contains a system() call that directly uses the wlanif request parameter. Based on the description, it is inferred that an attacker can supply crafted input to cause the system() function to execute arbitrary OS commands, leading to remote code execution on the device. This allows full control over the router, enabling modification of settings, installation of malicious software, or further lateral movement.

The affected product is the TOTOLINK N150RT router, specifically firmware version 3.4.0-B20201030. No other vendors or product lines are listed as impacted in the CNA data. The vulnerability is tied to the web‑management component of that single firmware release.

The CVSS score of 9.4 indicates critical severity. The EPSS score of 2% denotes a low but measurable exploitation probability, yet published exploits have been made public, elevating practical risk. The likely attack vector is remote, accessed over the shared web interface; authentication is not mentioned, suggesting the flaw may be reachable without credentials. The vulnerability is not present in the CISA KEV catalog, but its high severity and public exploit visibility warrant immediate remediation.