Totolink A3002MU: Five Critical Command Injection and Buffer Overflow Flaws Disclosed Together
Five critical vulnerabilities discovered in Totolink A3002MU routers, with CVSS scores up to 10.0, are being actively exploited.
Key findings
- Five critical vulnerabilities (CVSS 9.9-10.0) disclosed for Totolink A3002MU routers.
- Flaws include command injection and multiple buffer overflows, exploitable remotely.
- Publicly available exploits increase the risk of immediate exploitation.
- Vulnerabilities affect multiple functions within the router's firmware.
- Users urged to update firmware immediately due to critical severity.
On September 18-19, 2026, a batch of five critical vulnerabilities was disclosed for the Totolink A3002MU router, with CVSS scores ranging from 9.9 to 10.0. These flaws, identified by researchers and publicly disclosed, could allow remote attackers to execute arbitrary code or cause denial-of-service conditions on affected devices. The vulnerabilities were discovered in various functions within the router's firmware, including formWsc, formWlWds, formWlEncrypt, formWlAc, and formSchedule.
The vulnerabilities stem from improper handling of user-supplied input, leading to critical security issues. Specifically, CVE-2026-93742 involves command injection via the localPin argument in the formWsc function, while CVE-2026-93741, CVE-2026-93740, CVE-2026-93739, and CVE-2026-93738 all relate to buffer overflows. These buffer overflows are triggered by manipulating arguments such as submit-url in formWlWds, formWlEncrypt, and formWlAc, and webpage in formSchedule. The public availability of exploits for these vulnerabilities heightens the risk for users.
All five vulnerabilities affect the Totolink A3002MU router, identified by the build number Hh-B20211125.1046. The disclosures occurred within a 12-hour window, indicating a coordinated or closely timed release of security findings. Given the critical severity and the remote exploitability of these flaws, Totolink A3002MU users are strongly advised to check for and apply any available firmware updates. The specific firmware versions that contain fixes for these issues have not been detailed in the initial disclosures, but prompt action is recommended to mitigate the risk of exploitation.
This batch of vulnerabilities underscores the importance of timely patching for network devices, as critical flaws with publicly available exploits can pose an immediate threat to network security. Users should remain vigilant for any security advisories from Totolink and ensure their devices are running the latest stable firmware to protect against potential attacks. The widespread use of such routers in home and small business environments makes this disclosure particularly concerning.
The affected files include /boafrm/formWsc, /boafrm/formWlWds, /boafrm/formWlEncrypt, /boafrm/formWlAc, and /boafrm/formSchedule. The nature of the vulnerabilities—command injection and buffer overflows—allows for significant impact, including potential system compromise. The remote nature of the attacks means that devices connected to the internet are particularly vulnerable if not updated.
The coordinated disclosure of these critical vulnerabilities highlights a potential security oversight in the firmware of the Totolink A3002MU. While the exact timeline for patches is not yet clear, users should prioritize updating their devices as soon as possible. The public exploitability increases the urgency, as malicious actors could leverage these flaws to gain unauthorized access to networks.
The critical nature of these vulnerabilities, with CVSS scores reaching 10.0, means that successful exploitation could lead to complete device takeover. This could result in data theft, network disruption, or the router being used as a pivot point for further attacks within a network. The broad impact across multiple functions within the firmware suggests a systemic issue that requires thorough investigation and remediation by Totolink.
Users are urged to consult Totolink's official support channels for the most up-to-date information regarding firmware updates and security patches for the A3002MU model. Proactive security measures, including regular firmware checks and updates, are essential for maintaining the security posture of network infrastructure. The rapid disclosure and exploit availability emphasize the need for swift action from both the vendor and the end-users.