A stack‑based buffer overflow exists in the web management interface of the TOTOLINK N150RT router. The flaw is triggered by the ip_subnet and fw_ip parameters when adding a forwarding rule through the /boafrm/formPortFw endpoint. An attacker can exploit the overflow to corrupt the stack and execute arbitrary code, thereby compromising confidentiality, integrity, and availability of the device.

The vulnerability affects TOTOLINK N150RT (NTR150) routers running firmware version V3.4.0-B20201030. No other versions are listed in the available data.

Based on the description, it is inferred that the attack vector is a remote HTTP request to the exposed management interface. The CVSS score is 9.8 and the EPSS score is <1%; the vulnerability is not listed in the CISA KEV catalog, but the presence of a stack‑based buffer overflow in a publicly reachable web endpoint implies a high exploitation risk. An attacker with remote access to the device could gain full control of the router.