Description
TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function.
Published: 2026-02-17
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack‑based buffer overflow occurs in the static_ipv6 parameter of the formIpv6Setup function in TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 firmware. This allows an attacker to corrupt the stack and potentially execute arbitrary code, resulting in full compromise of the device. The weakness is classed as CWE‑121 and CWE‑787, indicating unchecked input handling leading to buffer overflows.

Affected Systems

The vulnerability affects TOTOLINK A3002RU_V3 routers running firmware version 3.0.0-B20220304.1804. The affected component is the router’s web interface handling IPv6 configuration via the formIpv6Setup API.

Risk and Exploitability

The CVSS score of 8.8 signifies high severity, and the EPSS score of less than 1% indicates exploitation likelihood is very low but not impossible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access through the router’s network interface; if the vulnerable API is exposed to the LAN or WAN, an attacker can send a crafted request to trigger the overflow.

Generated by OpenCVE AI on April 17, 2026 at 18:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest router firmware that addresses the formIpv6Setup buffer overflow.
  • If a recent firmware update is unavailable, restrict access to the IPv6 configuration interface by enabling firewall rules or placing the device in a separate VLAN.
  • Continuously monitor router logs for unusual IPv6 configuration attempts and block or inspect suspicious traffic.

Generated by OpenCVE AI on April 17, 2026 at 18:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Apr 2026 19:15:00 +0000

Type Values Removed Values Added
Title Stack‑Based Buffer Overflow in TOTOLINK A3002RU_V3 IPv6 Setup

Mon, 09 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-121
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 06 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 20 Feb 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a3002ru Firmware
Weaknesses CWE-787
CPEs cpe:2.3:h:totolink:a3002ru-v3:*:*:*:*:*:*:*:*
cpe:2.3:o:totolink:a3002ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink a3002ru Firmware
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 18 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink a3002ru-v3
Vendors & Products Totolink
Totolink a3002ru-v3

Tue, 17 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Description TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function.
References

Subscriptions

Totolink A3002ru-v3 A3002ru Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-03-09T16:51:58.728Z

Reserved: 2026-02-16T00:00:00.000Z

Link: CVE-2026-26736

cve-icon Vulnrichment

Updated: 2026-03-06T19:01:45.449Z

cve-icon NVD

Status : Modified

Published: 2026-02-17T19:21:57.603

Modified: 2026-03-09T17:16:17.260

Link: CVE-2026-26736

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T19:00:11Z

Weaknesses