A stack-based buffer overflow exists in the formIpQoS function of Totolink N300RT firmware, triggered by a crafted entry_name argument. The vulnerability, classified as CWE-119 and CWE-120, can be exploited remotely and may allow an attacker to overwrite memory, potentially leading to arbitrary code execution or complete device compromise. If leveraged successfully, it would grant the attacker full control over the device, exposing sensitive network traffic, disrupting service, and allowing further lateral movement within the local network.

The vulnerability affects Totolink N300RT router firmware version 3.4.0-B20250430. No other versions or products are listed as impacted in the available data.

The CVSS score is 8.6, indicating a high severity of risk. EPSS is not available, but the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation so far. However, attack may be performed from remote and published exploits exist, meaning the likelihood of real‑world exploitation is significant, especially if the device is exposed to the internet. The remote attack vector combined with the lack of an official patch or workaround elevates the risk for networks using the affected firmware.