rootpwn

critical · CVSS v3 9.9 · CVSS v4 9.4 · EPSS 0.0188

CVE-2026-93742

A critical command injection vulnerability exists within the formWsc function of the Totolink A3002MU firmware. The flaw stems from improper

Overview

A critical command injection vulnerability exists within the formWsc function of the Totolink A3002MU firmware. The flaw stems from improper sanitization of the localPin argument processed via the /boafrm/formWsc endpoint. Remote attackers can leverage this vulnerability to execute arbitrary commands on the underlying operating system.

Description

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Impact

Successful exploitation grants an unauthorized remote attacker complete administrative control over the affected router, resulting in a total compromise of confidentiality, integrity, and availability (CIA triad). Organizations utilizing this device risk full network exposure, traffic interception, and potential lateral movement into trusted internal segments.

Remediation

Apply the latest available vendor firmware updates or patches provided by Totolink to resolve the underlying command injection flaw. If patches are unavailable, restrict administrative access to trusted internal management interfaces and disable remote management entirely. Implement network segmentation and monitoring to detect anomalous traffic targeting the vulnerable endpoint.

Risk context

The vulnerability carries a critical severity rating with a CVSS v3 score of 9.9 and a CVSS v4 score of 9.4, indicating extreme risk due to ease of remote exploitation. The current EPSS score of 0.0188 combined with public exploit availability requires immediate prioritization of mitigation steps for any exposed legacy devices.

Affected products

  • Totolink A3002MU

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
9.4
EPSS
0.0188

cve command-injection totolink router critical remote-code-execution

← All CVEs

Related CVEs

critical

CVE-2026-89274

The WP Recipe Maker plugin for WordPress up to version 10.8.1 insecurely executes shortcodes found within structured recipe metadata fields derived from user comments. This allows unauthenticated users to trigger server-side shortcode execution and potentially disclose sensitive data through page metadata. Exploitation relies on the malicious comment passing the site's comment approval process.

View analysis

critical

CVE-2026-92229

The Forminator Forms plugin for WordPress contains an arbitrary shortcode execution vulnerability affecting versions up to 1.57.2. The issue stems from insufficient validation of user-supplied values prior to executing the do_shortcode function. This flaw allows unauthenticated remote attackers to execute arbitrary shortcodes within the application context.

View analysis

critical

CVE-2026-92807

The Save as PDF Plugin by PDFCrowd for WordPress suffers from an arbitrary function invocation vulnerability in versions up to 4.6.1. The flaw occurs because user-supplied shortcode attributes are unsanitized and later invoked as PHP callables via an unauthenticated AJAX endpoint. This allows low-privileged authenticated users to trigger unauthorized function executions and potentially disclose sensitive API credentials.

View analysis

critical

CVE-2026-93741

A critical stack-based buffer overflow vulnerability exists in the Totolink A3002MU router firmware within the formWlWds function. Specifically, improper handling of the submit-url parameter in requests to the /boafrm/formWlWds endpoint allows remote attackers to trigger memory corruption. This matters because successful exploitation could lead to arbitrary code execution or complete device compromise without authentication.

View analysis