CVE-2026-93741: Totolink A3002MU Buffer Overflow
TL;DR - CVE-2026-93741 is a critical remote buffer overflow in Totolink A3002MU firmware
Hh-B20211125.1046. - A public exploit reference exists, but active exploitation has not been confirmed by CISA KEV. - Restrict router administration immediately and verify whether Totolink provides a fixed firmware release.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2026-93741 |
| Product | Totolink A3002MU wireless router |
| Affected firmware/build | Hh-B20211125.1046 |
| CVSS score | 10.0, Critical |
| CVSS vector | Not included in the available NVD record; verify the complete NVD JSON before using vector-level conclusions |
| Attack vector | Remote |
| Authentication required | Not specified in the available record |
| Vulnerable component | formWlWds in /boafrm/formWlWds |
| Vulnerability type | Buffer overflow |
| Patch available | No vendor-confirmed fixed version identified |
CVE-2026-93741 affects the Totolink A3002MU web administration functionality. The available vulnerability record identifies a remotely triggerable buffer overflow caused by manipulating the submit-url argument submitted to the formWlWds handler.
The issue requires urgent treatment because the NVD record states that a public exploit has been released and may be used for attacks. However, the record does not establish the exploit’s reliability, whether it achieves code execution, or whether authentication is required. CISA’s Known Exploited Vulnerabilities catalog does not currently list this CVE.
What Is This Vulnerability?
The root cause is unsafe handling of the submit-url parameter by the formWlWds function. The affected handler is exposed through the router’s web administration interface at /boafrm/formWlWds. An attacker can provide an excessively long or malicious value that exceeds the destination buffer’s capacity, causing memory corruption.
The available technical information does not confirm the exact memory-safety failure mode beyond describing it as a buffer overflow. It also does not confirm whether the result is remote code execution, a service crash, denial of service, or another impact. Defenders should therefore avoid assuming that the vulnerability is limited to a crash, particularly because the affected device is a network appliance with privileged control over wireless and routing functions.
The NVD description states:
“A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.”
Technical Notes
The relevant attack surface is the following HTTP handler:
/boafrm/formWlWds
The vulnerable input is reported as:
submit-url
No authenticated request example, payload length, stack layout, or reliable exploitation sequence was available in the supplied research material. Do not reproduce or operationalize exploit payloads without authorization and an isolated test environment.
Who Is Affected?
The specifically identified affected device is the Totolink A3002MU wireless router running firmware or build:
Hh-B20211125.1046
This is the only affected version explicitly identified in the available NVD record. No complete version range was supplied, and the available information does not establish whether earlier or later A3002MU builds are vulnerable.
The available evidence also does not establish whether other Totolink products share the same vulnerable code or whether other firmware families use the same formWlWds implementation. Owners of related Totolink models should not assume they are affected, but they should inventory them and request product-specific guidance from the vendor.
Organizations should prioritize devices whose administrative interfaces are reachable from the Internet. A router behind a properly configured upstream firewall may have a materially smaller attack surface than a device with WAN-side administration enabled, but internal exposure still matters because a compromised endpoint or guest network may be able to reach the management interface.
CVSS Score Breakdown
The reported CVSS base score is 10.0, Critical. This is the score provided in the available NVD record. The complete CVSS vector string was not included in the returned record, so the individual metric values cannot be verified from the supplied data.
The attack vector is described as remote, which indicates that exploitation does not require physical access to the router. However, the available record does not specify the authentication requirement, user interaction requirement, scope, confidentiality impact, integrity impact, or availability impact. Those values should be obtained from the complete NVD record or an authoritative scoring source before publishing a detailed vector interpretation.
For operational purposes, a 10.0 score combined with a public exploit reference warrants emergency handling. Teams should not downgrade the risk solely because CISA KEV does not list the CVE. KEV inclusion is an important exploitation signal, but absence from the catalog is not evidence that exploitation is impossible or that the device is safe to expose.
Exploitation Status
Public PoC or exploit: Yes, according to the NVD description. The NVD record states that an exploit has been released publicly and may be used for attacks. An NVD-linked GitHub reference points to a research document describing the A3002MU issue:
The existence of that public reference is confirmed by the supplied research note. The precise payload, exploit reliability, authentication requirements, weaponization level, and post-exploitation behavior were not independently verified. The linked page should therefore be treated as a source of threat intelligence, not as proof of reliable remote code execution.
Active exploitation in the wild: Not confirmed. CVE-2026-93741 is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. There is no confirmed CISA date added, due date, ransomware campaign flag, or required action. The NVD statement that the exploit may be used for attacks indicates risk and availability of exploitation material, but it is not independent confirmation of real-world exploitation.
How to Detect It
Detection should begin with asset inventory and configuration review. Identify Totolink A3002MU devices, collect their firmware/build identifiers, and determine whether their administration interfaces are reachable from untrusted networks. Review router access logs, reverse-proxy logs, upstream firewall logs, and network telemetry for requests to /boafrm/formWlWds, especially requests containing unusually long submit-url values or repeated malformed requests.
A single request to the endpoint is not proof of exploitation because the path may be used by legitimate WDS administration. Detection confidence increases when the request comes from the WAN, contains an abnormal parameter length, is followed by a router restart, a management-service failure, unexpected configuration changes, or outbound connections from the router.
For broader monitoring context, see the log aggregation glossary.
Technical Notes
A Suricata rule can provide an initial alert for requests containing the vulnerable endpoint and parameter. This is a discovery-oriented signature, not a complete exploit detector:
alert http any any -> any any (
msg:"Potential CVE-2026-93741 Totolink A3002MU formWlWds access";
flow:established,to_server;
http.uri;
content:"/boafrm/formWlWds";
http.uri;
content:"submit-url";
distance:0;
classtype:attempted-admin;
sid:202693741;
rev:1;
)
Organizations using a SIEM can start with a query equivalent to:
http.request.uri.path:"/boafrm/formWlWds"
AND http.request.uri.query:*submit-url*
Add filters for external source addresses, unusually long request URIs, repeated requests, HTTP 4xx or 5xx responses, and router reboot or configuration-change events. The exact log field names vary by firewall, proxy, and SIEM platform.
Mitigation and Patching
No vendor-confirmed fixed firmware version was identified in the available information. The only explicitly affected build is Hh-B20211125.1046; do not claim that a newer build is safe unless Totolink release notes or direct vendor confirmation identify it as the fix. Check Totolink’s official support channels for an A3002MU firmware update and preserve the current configuration before upgrading.
Immediately remove WAN exposure to the management interface. Restrict administration to a trusted management VLAN, a dedicated internal subnet, or an organization-managed VPN. A consumer VPN product such as Check NordVPN pricing → does not replace network-level access controls or vendor patching. Disable remote administration and unused WDS functionality where the device’s operational requirements permit it. If the router is end-of-life or Totolink does not provide a security update, replacement is the most reliable remediation.
For general guidance on VPN necessity and limitations, see Do I really need a VPN?.
Technical Notes
Where an upstream Linux firewall controls access to the router’s management address, a temporary block can be applied with an example rule such as:
sudo iptables -I FORWARD -p tcp -d <ROUTER_IP> --dport 80 -j DROP
sudo iptables -I FORWARD -p tcp -d <ROUTER_IP> --dport 443 -j DROP
Replace <ROUTER_IP> with the router’s actual management address and adapt the rule to the correct interface, zone, and management policy. Do not apply these commands blindly on the router itself; many embedded devices do not use persistent iptables rules, and the commands may interrupt legitimate administration.
A safer policy is to permit management only from a trusted administration subnet:
sudo iptables -I FORWARD -s <TRUSTED_ADMIN_SUBNET> -d <ROUTER_IP> \\
-p tcp -m multiport --dports 80,443 -j ACCEPT
sudo iptables -I FORWARD -d <ROUTER_IP> \\
-p tcp -m multiport --dports 80,443 -j DROP
After applying network controls, verify from an external test location that the management interface is no longer reachable. Export configuration and record the current firmware before any upgrade. If no fixed firmware is available, maintain the network restriction, monitor for management requests and configuration changes, and plan replacement.
References
The primary technical source is the NVD-linked GitHub research reference:
Additional references identified in the available research note include the following CVE and vulnerability databases:
- NVD entry for CVE-2026-93741
- VulDB entry for CVE-2026-93741
- VulDB submission reference
- VulDB vulnerability reference
- VulDB CTI reference
The available research note reports that the VulDB page returned HTTP 403 during retrieval, so its contents were not independently verified. Totolink’s official support and advisory channels should be checked for a vendor-confirmed fixed version before declaring the vulnerability remediated.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.