Cyber & AI intelligence
Wasteland.
Briefs indexed2769
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-93740 2026-09-18

Totolink A3002MU Hit by Critical Unauthenticated Buffer Overflow (CVE-2026-93740)

"A publicly documented buffer overflow in the Totolink A3002MU router's `formWlEncrypt` handler lets an unauthenticated attacker reach the device remotely, and it carries a CVSS 3.1 base score of 10.0."

A publicly documented buffer overflow in the Totolink A3002MU router's formWlEncrypt handler lets an unauthenticated attacker reach the device remotely, and it carries a CVSS 3.1 base score of 10.0.

What Is It

CVE-2026-93740 is a buffer overflow in Totolink A3002MU firmware version Hh-B20211125.1046. The flaw sits in the function formWlEncrypt reached via the endpoint /boafrm/formWlEncrypt. Manipulation of the submit-url argument triggers the overflow. Per the NVD record, the attack can be initiated remotely, and the exploit is publicly available and might be used.

The issue is classified under CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (classic buffer copy without size check). It was published to NVD on 2026-09-18 by the VulDB CNA, and the record currently carries a status of "Received."

Why It Matters

The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, scores a maximum 10.0 CRITICAL. No privileges and no user interaction are required, attack complexity is low, and the scope is marked CHANGED, meaning impact extends beyond the vulnerable component itself. Confidentiality, integrity, and availability impacts are all HIGH.

The CVSS 4.0 base score from the same source is 9.3 CRITICAL, which reflects HIGH confidentiality, integrity, and availability impacts to the vulnerable system itself; the subsequent-system impacts are not rated HIGH, since a 4.0 vector carrying HIGH impacts on both the vulnerable and subsequent systems would score 10.0. Exploit maturity is rated PROOF_OF_CONCEPT, a threat metric that adjusts the derived threat score rather than the 9.3 base. A public write-up of the overflow exists on GitHub.

What's Vulnerable

Patch Status

CVE-2026-93740 does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing, so there is no federal confirmation of exploitation in the wild and no KEV-mandated required action or due date. That absence is not evidence the flaw is unexploited; a proof-of-concept is already public.

No vendor advisory, fixed firmware version, or remediation guidance for this CVE is publicly available; Totolink's site carries only general product information. Treat patch availability as unconfirmed and verify directly with Totolink. In the interim, restrict access to the device's web interface from untrusted networks and ensure it is not reachable from the internet.

Sources