CVE-2026-93740
CriticalCVSS 10.0Summary
A buffer overflow vulnerability was identified in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlEncrypt function of the /boafrm/formWlEncrypt file. Manipulation of the submit-url argument allows remote exploitation. The exploit is publicly available and may be used.
Risk Assessment
A network-accessible attacker can remotely trigger the buffer overflow, potentially leading to code execution or service disruption on the edge device. Since the exploit is public, the risk of rapid exploitation is high.
Recommendation
Update the Totolink A3002MU firmware to the latest version if the vendor provides a fix, or restrict access to the management interface to trusted networks. Consider disabling or isolating the vulnerable device until a patch is available.
Other vulnerabilities in Totolink A3002MU
See all- CVE-2026-93739Critical
A buffer overflow vulnerability was determined in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlAc function of the /boafrm/formWlAc file. Manipulation of the submit-url argument can lead to a buffer overflow. The attack may be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-93738Critical
A buffer overflow vulnerability was found in the Totolink A3002MU (version Hh-B20211125.1046) within the formSchedule function of the /boafrm/formSchedule file. Manipulation of the webpage argument results in a buffer overflow. The attack is possible remotely, and the exploit has been made public.
- CVE-2026-90608Critical
A buffer overflow vulnerability was found in Totolink A3002MU version Hh-B20211125.1046, in the formPortFw function of /boafrm/formPortFw (boa component). Manipulating the service_type argument causes the overflow. The attack can be initiated remotely and the exploit has been published.
- CVE-2026-90607Critical
A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formNewSchedule function of /boafrm/formNewSchedule (boa component). Manipulating the submit-url argument results in the overflow. The attack may be performed remotely and the exploit is now public.
- CVE-2026-90606Critical
A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formIpv6Setup function of /boafrm/formIpv6Setup (boa component). Manipulating the static_ipv6 argument leads to the overflow. The attack is possible remotely and the exploit has been disclosed publicly.
- CVE-2026-90605Critical
A buffer overflow weakness was identified in Totolink A3002MU version Hh-B20211125.1046, in the formFilter function of /boafrm/formFilter (boa component). Manipulating the ip6addr argument leads to the overflow. The attack can be executed remotely and the exploit has been made available to the public.
- CVE-2026-90604Low
A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. It affects an unknown part of the Anchor Tag Handler component and results in cross site scripting. Remote exploitation is possible, and the exploit has been publicly released.
Original NVD description (English source)
A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.