A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046.

CVE-2026-93741 is an unauthenticated stack buffer overflow in the formWlWds function of the Totolink A3002MU's embedded boa web server. An attacker sends an HTTP POST to /boafrm/formWlWds with a submit-url parameter containing ~1,200+ bytes, overflowing a fixed-size stack buffer and crashing the service — with likely potential for full remote code execution on the underlying MIPS Linux. The affected firmware is Hh-B20211125.1046, a build from November 2021. There is no patch, no vendor advisory, and no indication Totolink intends to release one. A public crash PoC is available on GitHub from researcher SunnyYANGyaya, who simultaneously disclosed at least six critical flaws (CVE-2026-93738 through CVE-2026-93742) in the same firmware, all exploiting different boa form handlers with the same class of bug.

The vendor CVSS of 10.0 is mathematically defensible — network-reachable, no auth, no interaction, full CIA impact with scope change. But CVSS does not ask *who actually runs this device*. The Totolink A3002MU is a ~$40 consumer dual-band Wi-Fi router sold primarily through Asian retail channels. It is not enterprise-class infrastructure. In a managed environment of 10,000+ hosts, the probability of finding one in your CMDB rounds to zero. If one surfaces — a forgotten branch closet, a remote worker's home — the answer is not 'patch it' but 'replace it,' because no patch exists or will ever exist. The real threat this CVE represents is botnet conscription: the Beastmode Mirai campaign integrated Totolink exploits within one week of PoC publication, and similar campaigns continued through 2025-2026. That matters to ISPs and internet hygiene — not to your enterprise patching queue.

1. Run asset discovery for Totolink devices across all managed segments — Use runZero/Rumble, Nmap (nmap -sV --script http-title), or your NAC platform to search for devices with boa web server headers or TOTOLINK HTML signatures on all managed network segments including branch offices. If you find zero, close this CVE as not-applicable and document the rationale. No noisgate mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window by running this scan within your next scheduled asset audit.
2. Replace any discovered A3002MU units with supported enterprise-grade equipment — There is no patch and never will be. The only remediation is physical replacement with a vendor-supported device (e.g., Cisco Meraki MR, Aruba Instant On, FortiAP, Ubiquiti UniFi). Open a procurement ticket, not a patching ticket. Target completion within the noisgate 365-day remediation SLA for MEDIUM severity.
3. Block WAN-side management on any discovered units immediately — If replacement cannot happen same-day, ensure the router's web management port (TCP/80) is unreachable from the WAN. Apply an ACL on the upstream device (ISP modem, perimeter firewall) to drop inbound HTTP to the Totolink's WAN IP. This eliminates the internet-facing attack surface while you procure a replacement.
4. Segment the device off managed networks via VLAN isolation — If an A3002MU is found on a managed LAN segment (e.g., plugged into a switch port in a branch office), isolate it immediately to a quarantine VLAN with no route to corporate resources. This contains the blast radius if the device is already compromised or gets compromised before replacement.

Run from an auditor workstation on the same network segment as the suspected Totolink device (or any host with HTTP reach to the target). Usage: chmod +x check_cve_2026_93741.sh && ./check_cve_2026_93741.sh 192.168.0.1. Requires only curl and grep. No elevated privileges needed. This script does not send an exploit payload — it fingerprints the device model and firmware version via the landing page only.

#!/usr/bin/env bash
# check_cve_2026_93741.sh — Totolink A3002MU CVE-2026-93741 presence check
# Usage: ./check_cve_2026_93741.sh <target_ip>
# Exit codes: 0=VULNERABLE, 1=PATCHED/NOT_AFFECTED, 2=UNKNOWN

set -uo pipefail

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <target_ip_or_hostname>"
  exit 2
fi

TIMEOUT=10
URL="http://${TARGET}/"

echo "[*] Probing $TARGET for Totolink A3002MU (CVE-2026-93741)..."

# Fetch the landing page including HTTP headers
RESPONSE=$(curl -sS -m "$TIMEOUT" -D- "$URL" 2>/dev/null) || true

if [[ -z "$RESPONSE" ]]; then
  echo "[!] No HTTP response from $TARGET — host may be down or not running HTTP."
  echo "UNKNOWN"
  exit 2
fi

# Check for Totolink or boa server signatures
IS_TOTOLINK=0
if echo "$RESPONSE" | grep -qi 'totolink'; then
  IS_TOTOLINK=1
elif echo "$RESPONSE" | grep -qi 'server:.*boa'; then
  IS_TOTOLINK=1
fi

if [[ "$IS_TOTOLINK" -eq 0 ]]; then
  echo "[-] Target does not appear to be a Totolink device (no TOTOLINK or boa signature found)."
  echo "PATCHED"
  exit 1
fi

echo "[+] Totolink/boa device detected at $TARGET."

# Check for A3002MU model string
if ! echo "$RESPONSE" | grep -qi 'A3002MU'; then
  echo "[?] Totolink device found but model is NOT A3002MU. This CVE may not apply."
  echo "UNKNOWN"
  exit 2
fi

echo "[+] Model confirmed: Totolink A3002MU."

# Check for vulnerable firmware version in page content
if echo "$RESPONSE" | grep -qi 'Hh-B20211125'; then
  echo "[!] FIRMWARE MATCH: Hh-B20211125.1046 detected."
  echo "[!] This device is VULNERABLE to CVE-2026-93741 (formWlWds buffer overflow)."
  echo "[!] ACTION: Replace this device immediately — no patch exists."
  echo ""
  echo "VULNERABLE"
  exit 0
fi

# Firmware string not found on landing page — probe the vulnerable endpoint
WDS_CODE=$(curl -sS -m "$TIMEOUT" -o /dev/null -w "%{http_code}" \
  -X POST "http://${TARGET}/boafrm/formWlWds" \
  -d "submit-url=test" 2>/dev/null) || WDS_CODE="000"

if [[ "$WDS_CODE" == "200" || "$WDS_CODE" == "302" ]]; then
  echo "[!] A3002MU with accessible /boafrm/formWlWds endpoint (HTTP $WDS_CODE)."
  echo "[!] Firmware version not confirmed from landing page — but endpoint is live."
  echo "[!] Treat as LIKELY VULNERABLE. Verify firmware version via admin panel."
  echo ""
  echo "VULNERABLE"
  exit 0
else
  echo "[?] A3002MU detected but firmware version unclear; formWlWds returned HTTP $WDS_CODE."
  echo "UNKNOWN"
  exit 2
fi

1. VulDB — CVE-2026-93741 Advisory
2. OffSeq Threat Radar — CVE-2026-93741 Analysis
3. GitHub PoC — formWlWds Buffer Overflow by SunnyYANGyaya
4. Fortinet — Beastmode Mirai Campaign Targeting Totolink Routers
5. TheHackerWire — CVE-2026-93741 Totolink A3002MU Buffer Overflow
6. BankInfoSecurity — Mirai Campaign Targets Unpatched Totolink Routers
7. HelpNetSecurity — Mirai Variants Target Routers via Old Flaws (Apr 2026)