A weakness has been identified in Totolink A3002MU Hh-B20211125.1046.

CVE-2026-93742 is a command injection flaw in the Totolink A3002MU AC1200 dual-band consumer Wi-Fi router, firmware version Hh-B20211125.1046 (dated November 2021). The vulnerable function formWsc in /boafrm/formWsc concatenates the user-supplied localPin parameter directly into a shell command without sanitization. An attacker who can POST to this endpoint with a valid session cookie (sessionCheck) can chain arbitrary OS commands (e.g., telnetd -p 8082 -l /firmadyne/sh) and achieve full root-level RCE on the device. Exploitation is trivial once you have both LAN access and an authenticated session. A public PoC is available on GitHub from researcher SunnyYANGyaya.

The vendor CVSS of 9.9 CRITICAL is mathematically defensible under the CVSS calculator — network-reachable, low complexity, low privilege, scope change — but it is wildly misleading in enterprise context. Totolink is a budget SOHO brand sold primarily through Asian e-commerce channels. The A3002MU has no enterprise market share, no centralized management plane, and no presence in any Fortune-5000 procurement catalog. The firmware is nearly five years old with no patch available and no evidence the product is still supported. For a security team managing 10,000 hosts, this CVE is relevant only if asset discovery turns up a rogue Totolink on your network — in which case the correct action is disposal, not patching.

1. Run asset discovery to identify any Totolink devices on your network — Use Nmap (nmap -sV -p 80,443,8080 --open <subnet>) or your existing asset inventory tool to scan for the boa web server fingerprint associated with Totolink routers. Any hit is a rogue device. As a LOW-severity item, there is no noisgate mitigation SLA — treat this as backlog hygiene and fold it into your next scheduled asset audit.
2. Decommission any discovered Totolink A3002MU devices immediately — There is no patch and no expectation of one. The only remediation is physical removal and replacement with a managed, enterprise-grade access point or router. Do not attempt to firewall-restrict the device and leave it in place — it is an unpatchable attack surface.
3. Block unknown/unmanaged devices via 802.1X or NAC — If you have 802.1X port-based authentication or a NAC solution (Cisco ISE, Aruba ClearPass, Forescout), ensure that unmanaged consumer devices cannot obtain network access. This is a strategic control that prevents the entire class of rogue-device vulnerabilities.
4. Segment IoT and unmanaged devices into a quarantine VLAN — If NAC is not deployed, VLAN segmentation ensures that even if a rogue consumer router is connected, it cannot reach production subnets. Apply strict ACLs preventing the quarantine VLAN from communicating with sensitive infrastructure.

Run this from any Linux/macOS auditor workstation that has network access to the suspected Totolink router's LAN IP. Usage: bash check_cve_2026_93742.sh 192.168.0.1. No special privileges required — it performs unauthenticated HTTP fingerprinting only (does NOT send an exploit payload).

#!/usr/bin/env bash
# check_cve_2026_93742.sh — Detect Totolink A3002MU vulnerable to CVE-2026-93742
# Usage: bash check_cve_2026_93742.sh <router_ip>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED/NOT_AFFECTED, 2 = UNKNOWN

set -euo pipefail

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <router_ip>"
  exit 2
fi

echo "[*] Checking $TARGET for Totolink A3002MU (CVE-2026-93742)..."

# Step 1: Fetch the login page and look for Totolink A3002MU identifiers
RESPONSE=$(curl -sk --max-time 10 "http://$TARGET/" 2>/dev/null || true)

if [[ -z "$RESPONSE" ]]; then
  echo "[!] No HTTP response from $TARGET"
  echo "UNKNOWN"
  exit 2
fi

# Check for Totolink branding
if ! echo "$RESPONSE" | grep -qi 'totolink\|TOTOLINK'; then
  echo "[-] Not a Totolink device."
  echo "PATCHED"
  exit 1
fi

echo "[+] Totolink device detected."

# Step 2: Check for the vulnerable endpoint existence (HEAD request only — no payload)
ENDPOINT_CHECK=$(curl -sk --max-time 10 -o /dev/null -w '%{http_code}' "http://$TARGET/boafrm/formWsc" 2>/dev/null || echo "000")

if [[ "$ENDPOINT_CHECK" == "000" ]]; then
  echo "[!] Could not reach /boafrm/formWsc endpoint."
  echo "UNKNOWN"
  exit 2
fi

# Step 3: Check for A3002MU model and firmware version
if echo "$RESPONSE" | grep -qi 'A3002MU'; then
  echo "[+] Model: Totolink A3002MU confirmed."
else
  echo "[*] Totolink device but model not confirmed as A3002MU."
  echo "UNKNOWN"
  exit 2
fi

# Step 4: Check firmware version if available in page source
FW_VERSION=$(echo "$RESPONSE" | grep -oiE 'Hh-B[0-9]+\.[0-9]+' | head -1 || true)

if [[ -n "$FW_VERSION" ]]; then
  echo "[+] Firmware: $FW_VERSION"
  if [[ "$FW_VERSION" == "Hh-B20211125.1046" ]]; then
    echo "[!] Firmware matches vulnerable version Hh-B20211125.1046"
  else
    echo "[*] Firmware differs from known vulnerable build but no patch exists — assume vulnerable."
  fi
else
  echo "[*] Could not extract firmware version from page source."
fi

# Step 5: Confirm endpoint is live (non-404 response to formWsc)
if [[ "$ENDPOINT_CHECK" != "404" && "$ENDPOINT_CHECK" != "000" ]]; then
  echo "[!] /boafrm/formWsc endpoint is reachable (HTTP $ENDPOINT_CHECK)."
  echo ""
  echo "========================================"
  echo "VULNERABLE — Totolink A3002MU with live formWsc endpoint."
  echo "No patch exists. Decommission this device."
  echo "========================================"
  echo "VULNERABLE"
  exit 0
else
  echo "[-] /boafrm/formWsc returned 404 — endpoint not present."
  echo "PATCHED"
  exit 1
fi

Sources

1. VulDB Entry — CVE-2026-93742
2. PoC by SunnyYANGyaya (GitHub)
3. TheHackerWire — CVE-2026-93742 Detail
4. OffSeq Threat Radar — Command Injection in Totolink A3002MU
5. Strix.ai — CVE-2026-93742 Fix & Details
6. Shenlong CVE Platform — A3002MU formWsc Intel
7. FIRST.org — EPSS Data
8. TheHackerWire — Totolink A3002MU RCE via formWsc