CVE-2026-93741

Received Received - Intake

Buffer Overflow in Totolink A3002MU Router

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulDB

Description

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93741

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	a3002mu	hh-b20211125.1046

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a buffer overflow flaw in Totolink A3002MU Hh-B20211125.1046. It exists in the function formWlWds of the file /boafrm/formWlWds. The issue is triggered by manipulating the argument submit-url, which can lead to memory corruption. The attack can be executed remotely, and a public exploit is available, increasing the risk of exploitation.

Impact Analysis

This vulnerability can allow remote attackers to execute arbitrary code or cause a denial of service on the affected device. Since it is remotely exploitable and a public exploit exists, attackers could gain control over the router, steal sensitive data, or disrupt network operations. Users of Totolink A3002MU devices should apply patches immediately if available.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. If exploited, it may result in data breaches, leading to legal penalties, loss of trust, and compliance violations. Organizations must address this flaw to maintain regulatory compliance.

Mitigation Strategies

Immediately update the Totolink A3002MU firmware to the latest version to patch the buffer overflow vulnerability in the formWlWds function. If an update is not available, consider isolating the device from untrusted networks or disabling the affected function if possible.

Hi! I’m here to help you understand CVE-2026-93741. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70