Is CVE-2026-100896 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100896 being exploited in the wild.

How severe is CVE-2026-100896?

Critical severity, with a CVSS score of 9.9, published 28 September 2026.

Which products and versions are affected?

TOTOLINK N150RT 3.4.0-B20201030.

Is there a fix for CVE-2026-100896?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100896 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-100896?

Check whether you run TOTOLINK N150RT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100896: TOTOLINK N150RT OS command injection in web management interface

CVE-2026-100896 · Severity: critical · CVSS 9.9 · Published 2026-09-28

TOTOLINK N150RT is a wireless router that provides web-based management for network configuration. An authenticated attacker can inject arbitrary operating system commands through the wireless interface configuration form, allowing them to execute commands with root privileges on the router. This enables complete device compromise, including data theft, device takeover, or use as a network attack platform.

Technologies: TOTOLINK N150RT. Vendors: TOTOLINK.

Quick answers

Is CVE-2026-100896 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100896 being exploited in the wild.
How severe is CVE-2026-100896?: Critical severity, with a CVSS score of 9.9, published 28 September 2026.
Which products and versions are affected?: TOTOLINK N150RT 3.4.0-B20201030.
Is there a fix for CVE-2026-100896?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100896 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-100896?: Check whether you run TOTOLINK N150RT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection (CWE-78) in the /boafrm/formWlSiteSurvey handler of the web management interface. The wlanif parameter is read from an authenticated POST request and concatenated directly into six separate system() shell commands without any input validation, whitelist enforcement, or character escaping. An authenticated attacker can supply shell metacharacters (e.g., wlanif=wlan0;command) to execute arbitrary commands as root, or supply values exceeding 31 bytes to trigger a secondary stack buffer overflow.

Affected products

TOTOLINK N150RT 3.4.0-B20201030

Timeline

2026-09-28: disclosed: Vulnerability disclosed in NVD and public PoC
2026-08-07: other: Public PoC published on GitHub by H3rmesk1t

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.