CVE-2026-93741 · Totolink A3002MU formWlWds submit-url Buffer Overflow

01 · The Real Story

A perfect-score fire alarm going off in an empty building you don't own

CVE-2026-93741 is a stack-based buffer overflow in the formWlWds function of the Boa web server (/boafrm/formWlWds) on the Totolink A3002MU AC1200 consumer Wi-Fi router, firmware version Hh-B20211125.1046. An unauthenticated remote attacker can send a POST request with an oversized submit-url parameter to overwrite adjacent memory, crashing the management interface and potentially achieving arbitrary code execution on the underlying MIPS/ARM embedded Linux. The affected firmware dates to November 2021, and no vendor patch exists or is expected — Totolink has not issued a fix for any of the dozen-plus CVEs filed against this firmware revision.

The vendor CVSS 10.0 is *technically* defensible for the raw bug class — unauthenticated, network-reachable, no user interaction, scope change, full CIA impact. But this score is wildly misleading for enterprise patching teams. The Totolink A3002MU is a budget SOHO router sold primarily in Asian consumer retail channels. It has zero presence in enterprise network infrastructure, which runs Cisco, Juniper, Aruba, Palo Alto, or Fortinet gear. Scanning Shodan for http.title:"TOTOLINK A3002MU" returns a negligible global footprint, almost entirely residential ISP address space. For a team managing 10,000 enterprise hosts, this CVE is background noise that should not consume a single hour of patching effort.

"Consumer router bug with a perfect 10 score — but your enterprise almost certainly doesn't own one."

02 · The Attack Path

3 steps from start to impact.

STEP 01

Identify exposed Totolink A3002MU management interface

The attacker scans for Totolink A3002MU devices with the Boa web server exposed to the network. The management UI listens on port 80/443 by default. Shodan dork http.title:"TOTOLINK A3002MU" or banner fingerprinting via Censys/FOFA can locate targets. No credentials are needed for this step.

Conditions required:

Target organization operates Totolink A3002MU routers
Management interface is network-reachable (LAN or WAN)

Where this breaks in practice:

Enterprise networks do not deploy Totolink consumer routers — device presence is near-zero in managed fleets
Even in SOHO contexts, remote management is typically disabled by default on this model; exploitation requires LAN access or explicit WAN management enablement

Detection/coverage: Shodan/Censys asset scans would flag the device, but most enterprise asset inventories will never encounter it.

STEP 02

Send crafted POST to /boafrm/formWlWds

The attacker sends an HTTP POST request to /boafrm/formWlWds with a submit-url parameter containing 600+ bytes of payload. The Boa web server's formWlWds handler copies this input into a fixed-size stack buffer using an unsafe string copy function (strcpy or equivalent) without length validation. This overwrites the return address on the stack.

Conditions required:

Network path to the Boa HTTP listener on the target device
No authentication required

Where this breaks in practice:

The device uses MIPS architecture with potential ASLR/NX on newer kernels, though this 2021 firmware likely lacks modern mitigations
Reliable RCE requires architecture-specific shellcode or ROP chain; the public PoC only demonstrates DoS (crash)

Detection/coverage: IDS/IPS signatures for oversized POST bodies to /boafrm/ paths would catch this trivially. WAFs are irrelevant — enterprise WAFs do not sit in front of consumer router admin panels.

STEP 03

Achieve code execution or denial of service

On successful exploitation, the attacker either crashes the Boa process (confirmed in the PoC — the router management interface becomes unresponsive) or, with a weaponized payload, achieves arbitrary code execution as root on the embedded Linux system. From this position the attacker controls the router's routing table, DNS settings, and traffic forwarding — enabling traffic interception or pivoting into the LAN.

Conditions required:

Successful stack smash with controlled EIP/PC
Architecture-compatible shellcode or ROP chain

Where this breaks in practice:

Public PoC by SunnyYANGyaya only demonstrates a crash (DoS), not RCE
Weaponizing to full RCE requires reverse-engineering the specific firmware binary for gadget addresses
Even with router compromise, lateral movement into an enterprise network from a consumer router is a separate, non-trivial step

Detection/coverage: Device going offline or rebooting would be visible in network monitoring. Post-compromise DNS hijacking could be detected by DNS integrity monitoring.

03 · Compensating Control

LOW 3.0→IGNORE 0.0

SEVERITY REDUCED

Run an asset inventory scan for Totolink devices — Query your CMDB, NAC, and network scanning tools (Nmap, Rumble/runZero) for any Totolink device fingerprints. If zero results, document the negative finding and close. This is the most likely outcome and costs minutes, not hours. No noisgate mitigation SLA applies at LOW severity — treat as backlog hygiene.

LOW 3.0→IGNORE 0.0

SEVERITY REDUCED

Replace any discovered A3002MU units with enterprise-grade equipment — If any Totolink A3002MU devices are found, replace them with supported enterprise access points or routers (Cisco, Aruba, Meraki). There is no patch and never will be. The device is permanently vulnerable to this and 10+ other critical CVEs in the same firmware. Treat as backlog hygiene per LOW severity.

LOW 3.0→LOW 2.5

Block Totolink management interfaces at the network boundary — If immediate replacement is not possible, ensure no Totolink management interfaces (port 80/443 on these devices) are reachable from untrusted networks. Apply ACLs on upstream switches/firewalls to restrict management access to a hardened admin VLAN only. This breaks the unauthenticated remote attack path.

What doesn't work

Firmware patching — no patch exists or is expected from Totolink. Do not wait for one.
WAF/IPS in front of the device — enterprise WAFs and IPS appliances do not inspect traffic to consumer router management interfaces on the LAN. Even if you wrote a custom signature, the architectural placement is wrong.
Disabling the web management interface — on most Totolink firmware, the Boa web server cannot be disabled without SSH access and manual process killing, which does not survive reboots. Not a reliable control.

04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	No confirmed in-the-wild exploitation of CVE-2026-93741 specifically. However, Totolink routers are a historically favored target of Mirai-variant botnets — the Beastmode campaign (2022) integrated Totolink exploits within one week of PoC publication (Fortinet). Botnet operators are likely to integrate this CVE given the public PoC.
Proof of concept	Public PoC available on GitHub: SunnyYANGyaya/cuicuishark-sheep-fishIOT. Demonstrates DoS via oversized `submit-url` POST to `/boafrm/formWlWds`. Includes IDA Pro analysis of the vulnerable code path. No weaponized RCE exploit is publicly available.
EPSS score	0.00657 (~93rd percentile). Low predicted exploitation probability, consistent with a niche consumer device with limited internet exposure.
KEV status	Not listed on CISA KEV as of 2026-10-09.
CVSS vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` — perfect 10.0. The Scope:Changed flag assumes compromise of the router enables downstream impact on connected hosts. Technically valid for the raw bug, but dramatically overstates enterprise risk.
Affected versions	Totolink A3002MU firmware Hh-B20211125.1046 (November 2021 build). Firmware V1.0.0-B20230403.1455 may also be affected based on related CVEs against the same codebase.
Patch status	No patch available. Totolink has not released a fix and is unlikely to — this is end-of-life consumer hardware with no vendor security response program. The device should be treated as permanently vulnerable.
Scanning / exposure data	Shodan dork `http.title:"TOTOLINK A3002MU"` returns a negligible footprint, overwhelmingly in residential ISP ranges in Southeast Asia and China. No GreyNoise tags exist for this CVE. No enterprise-relevant exposure observed.
Disclosure date	2026-09-19 — published to NVD and GitHub simultaneously.
Researcher / reporter	Reported by researcher SunnyYANGyaya via the cuicuishark-sheep-fishIOT IoT vulnerability research repository, which documents 10+ buffer overflow and command injection flaws in this single firmware build.

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to LOW (3.0/10)

Why this verdict

Near-zero enterprise install base: The Totolink A3002MU is a budget consumer/SOHO AC1200 router sold primarily through Asian retail channels. It has no enterprise distribution, no channel partner program for managed networks, and no presence in any enterprise procurement catalog. A team managing 10,000 hosts will not find this device in their CMDB.
PoC is DoS-only, not RCE: The public exploit by SunnyYANGyaya crashes the Boa process but does not achieve code execution. Weaponizing to RCE requires firmware-specific reverse engineering of a MIPS binary for ROP gadgets — non-trivial effort for a device with no strategic value.
No patch, no action possible: Totolink has not patched this firmware and will not — the device is effectively end-of-life. The only remediation is device replacement, which is moot for organizations that don't own the device.
EPSS confirms irrelevance: At 0.00657, EPSS ranks this in the bottom tier of exploitation probability. Not on KEV. No GreyNoise scanning tags. No named campaigns targeting this specific CVE.
Role multiplier: (a) *Low-value role* — the A3002MU is a consumer Wi-Fi router used in home/small-office settings. In enterprise contexts it would be shadow IT at best. (b) *Typical role* — does not exist; enterprises do not deploy this device. (c) *High-value role analysis* — the only plausible high-value scenario is if this router were used as a network edge appliance at a branch office. However, the Totolink A3002MU is NOT a canonical network edge appliance (those are F5, Palo Alto, Fortinet, Cisco ASA). Estimated share of enterprise network edge roles occupied by this device: <0.01%. The floor rule does not trigger because the affected component is not canonically a high-value-role component and fewer than 1% of installs occupy any high-value role.

Why not higher?

A MEDIUM rating would imply this CVE deserves scheduled remediation effort within 365 days. For an enterprise fleet, allocating any patching cycles to a consumer router that almost certainly isn't in your inventory is wasteful. The device's near-zero enterprise footprint, lack of weaponized exploit, and absence from KEV or any known campaign targeting enterprise networks all argue against spending resources on it.

Why not lower?

An IGNORE rating would mean no documentation is needed. The Mirai/Beastmode precedent — where Totolink exploits were weaponized within one week of PoC publication — warrants at least a brief asset inventory check and a documented decision. If any A3002MU units exist in your environment (remote worker equipment, acquired branch offices), the bug is real, unauth, and unpatchable. A LOW rating ensures you check and document rather than silently skip.

06 · Verification

Crowdsourced verification payload.

Run this script from any Linux/macOS host on the same network segment as potential Totolink devices. It scans a given subnet for Totolink A3002MU HTTP banners. Usage: chmod +x check_totolink.sh && ./check_totolink.sh 192.168.1.0/24. Requires nmap and curl installed. No elevated privileges needed unless scanning restricted subnets.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_totolink.sh — Scan for Totolink A3002MU devices (CVE-2026-93741)
# Usage: ./check_totolink.sh <subnet>
# Exit codes: 1 = VULNERABLE (device found), 0 = PATCHED (no devices), 2 = UNKNOWN (scan error)

set -euo pipefail

SUBNET="${1:-}"
if [ -z "$SUBNET" ]; then
  echo "Usage: $0 <subnet e.g. 192.168.1.0/24>"
  exit 2
fi

if ! command -v nmap &>/dev/null; then
  echo "ERROR: nmap is required but not installed."
  exit 2
fi

echo "[*] Scanning $SUBNET for HTTP services on ports 80,443,8080..."
HOSTS=$(nmap -sn "$SUBNET" -oG - 2>/dev/null | awk '/Up$/{print $2}')

if [ -z "$HOSTS" ]; then
  echo "[*] No live hosts found in $SUBNET."
  echo "UNKNOWN"
  exit 2
fi

FOUND=0
for HOST in $HOSTS; do
  for PORT in 80 443 8080; do
    RESP=$(curl -sk --max-time 3 "http://${HOST}:${PORT}/" 2>/dev/null || true)
    if echo "$RESP" | grep -qi "TOTOLINK\|A3002MU"; then
      echo "[!] VULNERABLE — Totolink A3002MU detected at ${HOST}:${PORT}"
      # Check firmware version in page content
      if echo "$RESP" | grep -qi "Hh-B20211125\|B20230403"; then
        echo "    Firmware matches known-vulnerable build."
      fi
      FOUND=1
    fi
  done
done

if [ "$FOUND" -eq 1 ]; then
  echo ""
  echo "VULNERABLE — Totolink A3002MU device(s) found. These are permanently vulnerable to CVE-2026-93741. Replace immediately."
  exit 1
else
  echo "[*] No Totolink A3002MU devices detected in $SUBNET."
  echo "PATCHED"
  exit 0
fi