Description
A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Published: 2026-09-18
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Buffer Overflow leading to potential remote code execution
Action: Immediate Patch
AI Analysis

Impact

A buffer overflow exists in the formWlAc function of Totolink A3002MU firmware Hh-B20211125.1046 when processing the submit-url argument, allowing an attacker to overwrite memory and execute arbitrary code. The vulnerability is classified as CWE-119 and CWE-120 and can be triggered from a remote network location.

Affected Systems

The affected device is the Totolink A3002MU model running firmware version Hh-B20211125.1046. No other models or firmware revisions are currently documented as vulnerable.

Risk and Exploitability

The CVSS score of 9.4 indicates a severe risk level. The EPSS score is not available, but the vulnerability has been publicly disclosed and could be actively exploited. The device can be attacked remotely through the formWlAc interface, and the exploit can be executed by sending a crafted submit-url value. The vulnerability is not listed in the CISA KEV catalog at this time, but the high severity and remote nature warrant immediate attention.

Generated by OpenCVE AI on September 19, 2026 at 10:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy any available firmware update that patches the formWlAc buffer overflow.
  • Disable or restrict remote access to the device’s web interface, especially the formWlAc endpoint, and limit it to trusted IP ranges.
  • If an update cannot be applied immediately, implement a firewall rule or access control list to block or filter malformed submit-url requests to the device.

Generated by OpenCVE AI on September 19, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Title Totolink A3002MU formWlAc buffer overflow
First Time appeared Totolink
Totolink a3002mu
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:a:totolink:a3002mu:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a3002mu
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Totolink A3002mu
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-23T17:50:46.626Z

Reserved: 2026-09-18T15:43:41.443Z

Link: CVE-2026-93739

cve-icon Vulnrichment

Updated: 2026-09-23T17:50:43.927Z

cve-icon NVD

Status : Deferred

Published: 2026-09-18T22:17:10.710

Modified: 2026-09-23T18:17:11.477

Link: CVE-2026-93739

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T00:15:06Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')