CVE-2026-93738
CriticalCVSS 9.9Summary
A buffer overflow vulnerability was found in the Totolink A3002MU (version Hh-B20211125.1046) within the formSchedule function of the /boafrm/formSchedule file. Manipulation of the webpage argument results in a buffer overflow. The attack is possible remotely, and the exploit has been made public.
Risk Assessment
A remote attacker can exploit the buffer overflow, potentially leading to code execution or device crash. Public availability of the exploit increases the risk of rapid exploitation.
Recommendation
Update the Totolink A3002MU firmware to the latest version if the vendor provides a fix, or restrict access to the management interface. Consider disabling or isolating the vulnerable device until a patch is available.
Other vulnerabilities in Totolink A3002MU
See all- CVE-2026-93740Critical
A buffer overflow vulnerability was identified in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlEncrypt function of the /boafrm/formWlEncrypt file. Manipulation of the submit-url argument allows remote exploitation. The exploit is publicly available and may be used.
- CVE-2026-93739Critical
A buffer overflow vulnerability was determined in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlAc function of the /boafrm/formWlAc file. Manipulation of the submit-url argument can lead to a buffer overflow. The attack may be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-90608Critical
A buffer overflow vulnerability was found in Totolink A3002MU version Hh-B20211125.1046, in the formPortFw function of /boafrm/formPortFw (boa component). Manipulating the service_type argument causes the overflow. The attack can be initiated remotely and the exploit has been published.
- CVE-2026-90607Critical
A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formNewSchedule function of /boafrm/formNewSchedule (boa component). Manipulating the submit-url argument results in the overflow. The attack may be performed remotely and the exploit is now public.
- CVE-2026-90606Critical
A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formIpv6Setup function of /boafrm/formIpv6Setup (boa component). Manipulating the static_ipv6 argument leads to the overflow. The attack is possible remotely and the exploit has been disclosed publicly.
- CVE-2026-90605Critical
A buffer overflow weakness was identified in Totolink A3002MU version Hh-B20211125.1046, in the formFilter function of /boafrm/formFilter (boa component). Manipulating the ip6addr argument leads to the overflow. The attack can be executed remotely and the exploit has been made available to the public.
- CVE-2026-90604Low
A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. It affects an unknown part of the Anchor Tag Handler component and results in cross site scripting. Remote exploitation is possible, and the exploit has been publicly released.
Original NVD description (English source)
A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.