by Kastro
Paper/Archive/CVE-2026-93741

CVE-2026-93741

Totolink A3002MU — Totolink A3002MU formWlWds buffer overflow

EPSS 0.7%public exploitCVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 51.5.515 × 2010.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Affected

ProductAffectedFixed inSource
A3002MUHh-B20211125.1046–CNA

Scores by source

VulDB (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
VulDB (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvuldb.com/vuln/407551refvuldb.com/vuln/407551/ctiwriteupvuldb.com/cve/CVE-2026-93741writeupvuldb.com/submit/914020exploitgithub.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formWlWds.mdreftotolink.net