CVE-2026-7219

Totolink N300RT formIpQoS buffer overflow

View on CVE.org
Published Apr 28, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Description
A flaw has been found in Totolink N300RT 3.4.0-B20250430. This affects an unknown function of the file /boafrm/formIpQoS. Executing a manipulation of the argument entry_name can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.

Analysis

AI-generated

Technical impact

A stack-based buffer overflow exists in the formIpQoS function of Totolink N300RT firmware, triggered by a crafted entry_name argument. The vulnerability, classified as CWE-119 and CWE-120, can be exploited remotely and may allow an attacker to overwrite memory, potentially leading to arbitrary code execution or complete device compromise. If leveraged successfully, it would grant the attacker full control over the device, exposing sensitive network traffic, disrupting service, and allowing further lateral movement within the local network.

Affected Systems

The vulnerability affects Totolink N300RT router firmware version 3.4.0-B20250430. No other versions or products are listed as impacted in the available data.

Risk and Exploitability

The CVSS score is 8.6, indicating a high severity of risk. EPSS is not available, but the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation so far. However, attack may be performed from remote and published exploits exist, meaning the likelihood of real‑world exploitation is significant, especially if the device is exposed to the internet. The remote attack vector combined with the lack of an official patch or workaround elevates the risk for networks using the affected firmware.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the device to the latest firmware provided by Totolink, ensuring the buffer overflow patch is included.
  • Restrict remote access to the device by disabling web management or configuring firewall rules to block traffic to the /boafrm/formIpQoS endpoint.
  • Continuously monitor network traffic and logs for abnormal patterns that may indicate exploitation attempts against the router.

Generated by OpenCVE AI on April 28, 2026 at 12:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink n300rt
Vendors & Products Totolink n300rt
Type Values Removed Values Added
Description A flaw has been found in Totolink N300RT 3.4.0-B20250430. This affects an unknown function of the file /boafrm/formIpQoS. Executing a manipulation of the argument entry_name can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.
Title Totolink N300RT formIpQoS buffer overflow
First Time appeared Totolink
Totolink n300rt Firmware
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:o:totolink:n300rt_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink n300rt Firmware
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 29, 2026, 2:13 PM
Reserved
Apr 27, 2026, 3:29 PM

View source JSON

Updated
Apr 29, 2026, 2:13 PM

JSON

Status
Deferred
Published
Apr 28, 2026, 4:16 AM
Modified
Jul 24, 2026, 8:10 AM

View source JSON

No data.

Updated
Apr 28, 2026, 12:45 PM

JSON