CVE-2026-93742: Totolink A3002MU Command Injection via formWsc

Overview

A critical command injection vulnerability has been disclosed in the Totolink A3002MU wireless router, firmware version Hh-B20211125.1046. Tracked as CVE-2026-93742 and rated 9.9 (Critical) on the CVSS 3.1 scale, the flaw sits in the formWsc handler behind /boafrm/formWsc — the endpoint that processes WPS (Wi-Fi Protected Setup) configuration requests.

The localPin argument passed to formWsc is not sanitized before being used to build a system command, allowing an unauthenticated remote attacker to inject arbitrary shell commands. A working proof-of-concept has already been published, so this should be treated as actively exploitable.

Technical Details

How It Works

formWsc is the WPS configuration endpoint that lets a device join the router's Wi-Fi network without manually entering a password. The handler takes the localPin value from an incoming request and passes it — unvalidated — into a shell command executed on the router's underlying Linux OS. By embedding shell metacharacters in localPin, an attacker can append arbitrary commands that execute with the router's privileges.

Because WPS handling happens before any session authentication, the attack requires no credentials: a single crafted HTTP request to /boafrm/formWsc is enough to achieve remote code execution.

Impact Assessment

A successful exploit gives the attacker a shell on the router itself, which typically enables:

• Full compromise of the device, including persistence via modified firmware or startup scripts
• Interception, redirection, or manipulation of all LAN traffic passing through the router (DNS hijacking, traffic sniffing)
• Use of the device as a foothold for further attacks against the internal network
• Recruitment into IoT botnets for DDoS or proxying malicious traffic

Consumer and small-office routers like the A3002MU are frequently internet-facing via remote management or UPnP-exposed WPS, making this a prime target for mass scanning and botnet recruitment.

Mitigation

• Disable WPS entirely in the router's admin settings if the feature is not required — this closes the vulnerable code path outright
• Check for a firmware update from Totolink addressing CVE-2026-93742; at time of writing no vendor patch has been confirmed
• Restrict management interfaces so /boafrm/ endpoints are not reachable from the WAN side
• Segment or replace unsupported/EOL Totolink hardware where patching isn't available — this model line has a history of unresolved command injection reports

Detection

• Watch for unusual outbound connections or DNS resolver changes originating from router-assigned IPs
• Monitor for unexpected processes or modified /etc startup files on devices where shell access is possible
• Flag repeated or malformed POST requests to /boafrm/formWsc at the network edge

References

• NVD — CVE-2026-93742
• CISA Known Exploited Vulnerabilities Catalog