by Kastro
Paper/Archive/CVE-2026-93742

CVE-2026-93742

Totolink A3002MU — Totolink A3002MU formWsc command injection

EPSS 2%public exploitCVSS 9.9
critical.is priorityof 100
56
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 83.1.831 × 2016.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Affected

ProductAffectedFixed inSource
A3002MUHh-B20211125.1046–CNA

Scores by source

VulDB (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

writeupvuldb.com/vuln/407552refvuldb.com/vuln/407552/ctiwriteupvuldb.com/cve/CVE-2026-93742writeupvuldb.com/submit/914021exploitgithub.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/rce-formWsc.mdreftotolink.net