A buffer overflow in the Totolink A3002MU router's formWlWds handler lets unauthenticated attackers compromise the device remotely, carrying a maximum CVSS 3.1 base score of 10.0, with proof-of-concept exploit code publicly available.
What Is It
CVE-2026-93741 is a buffer overflow in the formWlWds function of the file /boafrm/formWlWds on Totolink A3002MU firmware version Hh-B20211125.1046. Manipulation of the submit-url argument triggers the overflow. The attack can be launched remotely, and no authentication or user interaction is required. The issue is classified under CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (classic buffer overflow).
Why It Matters
The flaw scores 10.0 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), network attack vector, low complexity, no privileges, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. The CVSS 4.0 assessment rates it 9.3 CRITICAL, reflecting high confidentiality, integrity, and availability impact on the vulnerable system itself, with no subsequent-system impact scored.
Critically, exploit code has been publicly released. CVSS 4.0 exploit maturity is recorded as PROOF_OF_CONCEPT, and the NVD description states the exploit "may be used for attacks." Public proof-of-concept code targeting an internet-facing router with no authentication requirement makes this a low-effort target for opportunistic attackers.
There is no CISA KEV entry for this CVE in the supplied data, so active in-the-wild exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: Totolink
- Product: A3002MU router
- Affected version: Hh-B20211125.1046
- Affected component:
formWlWdsfunction in/boafrm/formWlWds - Affected parameter:
submit-url
Patch Status
The supplied NVD record does not list a patch, fixed version, or vendor advisory. CVE status is "Received" as of its 2026-09-19 publication, and no CISA KEV required action or remediation deadline applies. Operators running the affected firmware should treat the device's web management interface as exposed and restrict network access to it until the vendor publishes a fix.