CVE-2026-105286

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-07

Assigner: VulDB

Description

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105286

EUVD

EUVD-2026-92385

Affected Vendors & Products

Vendor	Product	Version / Range
Totolink	A3002MU	1.0.0-B20230403.1455

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a Path Traversal vulnerability in the TOTOLINK A3002MU router version 1.0.0-B20230403.1455. It exists in the file upload handler at /boafrm/formUploadFile. The flaw allows attackers to write arbitrary files to the filesystem as root by manipulating the filename parameter in file uploads. The filename is not properly sanitized, enabling path traversal sequences like ../../ to escape the intended upload directory.

Detection Guidance

Check for unusual file uploads in the /var/web/fw/ directory of the Totolink A3002MU device.
Monitor network traffic for POST requests to /boafrm/formUploadFile with suspicious filename parameters containing path traversal sequences like ../../.
Inspect web server logs for unexpected file writes or modifications in the web document root (/var/web/).

Impact Analysis

This vulnerability can allow remote attackers to upload malicious files to the router's filesystem without authentication. These files could be served from the web document root, enabling credential phishing, persistent defacement of the router's web interface, or even remote code execution if an executable file is overwritten. The attack can be executed over the network or management interface.

Compliance Impact

This vulnerability allows unauthenticated attackers to write arbitrary files to the filesystem as root via path traversal. This could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Apply the latest firmware update from Totolink to patch the path traversal vulnerability in the file upload handler.
Disable or restrict access to the /boafrm/formUploadFile endpoint if not required.
Implement strict input validation for the filename parameter to prevent path traversal sequences.
Monitor for unauthorized file uploads and remove any suspicious files from the filesystem.

Hi! I’m here to help you understand CVE-2026-105286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70