CVE-2026-7219

Totolink N300RT formIpQoS buffer overflow

State: Published
Severity: 8.6 High
Published: Apr 28, 2026
Updated: Apr 29, 2026
Reserved: Apr 27, 2026

Description

A flaw has been found in Totolink N300RT 3.4.0-B20250430. This affects an unknown function of the file /boafrm/formIpQoS. Executing a manipulation of the argument entry_name can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	7.2 High	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	8.3 High	AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-120 Buffer Overflow
CWE-119 Memory Corruption

Affected Products

Product	Versions
N300RTTotolink	3.4.0-B20250430Affected

References

VDB-359819 | Totolink N300RT formIpQoS buffer overflowvdb-entrytechnical-description
VDB-359819 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #808194 | TOTOLINK N300RT Router V3.4.0-B20250430 Buffer Overflowthird-party-advisory
https://github.com/xiaohaiyang-ai/IoT-Vulnerability-Research/tree/main/Vendors/TOTOLINK/N300RT/formIpQoS-Bofexploit
https://www.totolink.net/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.