CVE-2026-93741
CriticalCVSS 10.0Summary
A vulnerability has been discovered in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWlWds function of the /boafrm/formWlWds file. Manipulation of the submit-url argument results in a buffer overflow. The attack can be launched remotely, and a public exploit has already been released.
Risk Assessment
A remote attacker can exploit the buffer overflow to crash the device or potentially execute arbitrary code. This may lead to network disruption or full takeover of the router.
Recommendation
Update the Totolink A3002MU firmware to the latest version if the vendor provides one. Until a fix is available, restrict access to the administrative interface to trusted networks and monitor the device for unusual reboots.
Other vulnerabilities in Totolink A3002MU
See all- CVE-2026-93742Critical
A vulnerability has been identified in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWsc function of the /boafrm/formWsc file. Manipulation of the localPin argument leads to command injection. The attack can be launched remotely, and a public exploit is already available.
- CVE-2026-93740Critical
A buffer overflow vulnerability was identified in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlEncrypt function of the /boafrm/formWlEncrypt file. Manipulation of the submit-url argument allows remote exploitation. The exploit is publicly available and may be used.
- CVE-2026-93739Critical
A buffer overflow vulnerability was determined in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlAc function of the /boafrm/formWlAc file. Manipulation of the submit-url argument can lead to a buffer overflow. The attack may be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-93738Critical
A buffer overflow vulnerability was found in the Totolink A3002MU (version Hh-B20211125.1046) within the formSchedule function of the /boafrm/formSchedule file. Manipulation of the webpage argument results in a buffer overflow. The attack is possible remotely, and the exploit has been made public.
- CVE-2026-90608Critical
A buffer overflow vulnerability was found in Totolink A3002MU version Hh-B20211125.1046, in the formPortFw function of /boafrm/formPortFw (boa component). Manipulating the service_type argument causes the overflow. The attack can be initiated remotely and the exploit has been published.
- CVE-2026-90607Critical
A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formNewSchedule function of /boafrm/formNewSchedule (boa component). Manipulating the submit-url argument results in the overflow. The attack may be performed remotely and the exploit is now public.
- CVE-2026-90606Critical
A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formIpv6Setup function of /boafrm/formIpv6Setup (boa component). Manipulating the static_ipv6 argument leads to the overflow. The attack is possible remotely and the exploit has been disclosed publicly.
- CVE-2026-90605Critical
A buffer overflow weakness was identified in Totolink A3002MU version Hh-B20211125.1046, in the formFilter function of /boafrm/formFilter (boa component). Manipulating the ip6addr argument leads to the overflow. The attack can be executed remotely and the exploit has been made available to the public.
- CVE-2026-90604Low
A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. It affects an unknown part of the Anchor Tag Handler component and results in cross site scripting. Remote exploitation is possible, and the exploit has been publicly released.
Original NVD description (English source)
A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.