The Totolink N300RT router firmware 3.4.0-B20250430 contains a buffer overflow vulnerability in an unknown function of the /boafrm/formIpQoS file. By manipulating the entry_name argument, an attacker with high privileges can remotely trigger a buffer overflow condition. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. Exploit code has been published, but no confirmed exploitation in the wild is reported. No vendor remediation or patch information is currently available.

Successful exploitation of this vulnerability could allow a remote attacker with high privileges to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. The impact affects confidentiality, integrity, and availability of the system. Given the high CVSS score and remote exploitability, this poses a significant risk to affected devices if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting network exposure of the affected device, restricting access to trusted networks, and monitoring for unusual activity related to the /boafrm/formIpQoS interface. Avoid exposing the device management interface to untrusted networks. Follow vendor communications for updates on patches or official mitigations.