A buffer overflow in the formSchedule handler of the Totolink A3002MU router could allow a remote, low-privileged attacker to compromise the device, and a proof-of-concept write-up is reported to be publicly available.
What Is It
CVE-2026-93738 is a buffer overflow (CWE-119 / CWE-120) in Totolink A3002MU firmware version Hh-B20211125.1046. The flaw sits in the formSchedule function of the file /boafrm/formSchedule, where manipulation of the webpage argument overflows a buffer. The attack can be carried out remotely over the network.
The CVE was published on 2026-09-18 by VulDB ([email protected]) and currently carries a vulnerability status of "Received."
Why It Matters
VulDB records a base score of 9.9 (CRITICAL) with the vector string CVSS:4.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That record is internally inconsistent: the vector is prefixed CVSS:4.0, but its metrics, in particular the Scope (S:C) component, are CVSS 3.1 syntax, and CVSS 4.0 has no Scope metric. The 9.9 should therefore be read as a CVSS 3.1 base score with a mislabeled prefix, not as a 4.0 score. VulDB separately lists a CVSS 4.0 score of 8.6 (HIGH) and a CVSS 2.0 score of 9.0.
Read as CVSS 3.1, the metrics describe a network-reachable flaw with low attack complexity, no user interaction, and only low privileges required. The scope is CHANGED, with HIGH impact to confidentiality, integrity, and availability, meaning a successful attack would reach beyond the vulnerable component itself.
The VulDB description states the exploit has been made public and could be used, and the CVSS 4.0 exploit maturity is rated PROOF_OF_CONCEPT. The linked artifact is a GitHub write-up of the overflow rather than a packaged, verified exploit; the extent to which it constitutes working attack code has not been independently confirmed here.
CISA KEV does not list this CVE, so there is no confirmed evidence of active exploitation in the wild at this time, but publicly documented attack details against an internet-facing consumer router narrow the gap between disclosure and abuse.
What's Vulnerable
- Vendor: Totolink
- Product: A3002MU
- Affected version: Hh-B20211125.1046
- CPE:
cpe:2.3:a:totolink:a3002mu:*:*:*:*:*:*:*:*
No other versions or products are listed as affected in the supplied VulDB record.
Patch Status
The supplied source material lists no patch, fixed version, vendor advisory, or required remediation action. The only vendor reference provided is Totolink's main website. Because no fix is documented, operators running the affected firmware should treat the device's management interface as exposed and restrict network access to it until the vendor publishes guidance.