Executive Summary
A maximum-severity buffer overflow vulnerability (CVE-2026-93741) has been disclosed in the Totolink A3002MU router, firmware version Hh-B20211125.1046. The flaw carries a perfect CVSS score of 10.0 and can be triggered remotely without authentication via the device's embedded Boa web management interface.
CVSS Score: 10.0 (Critical)
The vulnerable function, formWlWds in /boafrm/formWlWds, copies the submit-url argument into a fixed-size buffer without verifying its length before the copy. An attacker who submits an excessively long or malformed submit-url value can overwrite adjacent memory, corrupting device state or achieving code execution. Public exploit code for this vulnerability is already circulating, and no vendor patch is currently available.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-93741 |
| CVSS Score | 10.0 (Critical) |
| CWE | CWE-120 (Buffer Copy Without Checking Size of Input) |
| Type | Remote Buffer Overflow |
| Attack Vector | Network (device's web management interface) |
| Privileges Required | None documented — exploit is remotely triggerable |
| Affected Function | formWlWds in /boafrm/formWlWds |
| Vulnerable Parameter | submit-url |
| Exploit Status | Public exploit released |
Affected Devices
| Device | Affected Firmware | Fixed Firmware |
|---|---|---|
| Totolink A3002MU | Hh-B20211125.1046 | Not yet available |
This is one of several related buffer overflow issues recently disclosed in Totolink A3002MU firmware; similar flaws have been found in other submit-url-handling functions such as formWlEncrypt and formWlAc, suggesting a systemic lack of input-length validation across the device's Boa-based web management endpoints.
Attack Vector
1. Attacker identifies a Totolink A3002MU with its web admin interface reachable
2. Attacker sends a crafted HTTP request to /boafrm/formWlWds
3. The submit-url argument contains an oversized or malformed payload
4. formWlWds copies the value into a fixed-size buffer without bounds checking
5. Adjacent memory is overwritten, corrupting control flow
6. Depending on exploit sophistication, this can crash the device (DoS) or yield RCEBecause the embedded Boa web server is a common target across many consumer router models, any A3002MU with its administrative interface exposed to the internet — either directly or via port forwarding/UPnP — is at immediate risk of both denial of service and full compromise.
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Denial of Service | Device crash/reboot from a malformed request |
| Remote Code Execution | Full compromise of the router's control plane |
| Network Pivot | A compromised router can intercept, redirect, or MITM all LAN traffic |
| Botnet Recruitment | Public exploit availability makes this an attractive IoT botnet target |
Immediate Remediation
No official firmware fix has been published at the time of writing. Until Totolink releases a patch, apply compensating controls:
Step 1: Restrict Access to the Admin Interface
- Disable remote/WAN administration in the router's settings
- Ensure the web management interface is reachable only from trusted LAN devices
- Disable UPnP if not required, to prevent unintended port exposure
Step 2: Network-Level Controls
- Block inbound WAN traffic to the router's admin HTTP/HTTPS port at the ISP or upstream firewall
- Segment the router's management interface onto a separate VLAN where possible
- Monitor for unusual traffic to /boafrm/ endpointsStep 3: Monitor for Firmware Updates
- Check Totolink's official support pages periodically for a firmware release addressing CVE-2026-93741
- Subscribe to CVE/NVD alerts for the A3002MU model
If the Device Cannot Be Secured
- Replace the device with a router receiving active security updates, if a fix is not released promptly
- Isolate the device behind an additional firewall if it must remain in service
Detection Indicators
| Indicator | Description |
|---|---|
Unusually long submit-url parameters in requests to /boafrm/formWlWds | Exploitation attempt |
| Unexpected device reboots or admin interface crashes | Possible DoS exploitation |
| Unrecognized outbound connections from the router | Possible post-exploitation compromise |
Post-Remediation Steps
- Verify remote administration is disabled on all A3002MU deployments
- Audit firewall rules to confirm the admin interface isn't internet-reachable
- Track vendor firmware releases and apply the fix as soon as it's available
- Reset admin credentials as a precaution if remote access was previously enabled
- Consider device replacement if Totolink does not ship a timely patch