CVE-2026-105286: Totolink A3002MU Path Traversal Vulnerability

CVE-2026-105286 Overview

CVE-2026-105286 is a path traversal vulnerability [CWE-22] in the Totolink A3002MU router running firmware version 1.0.0-B20230403.1455. The flaw resides in the sub_44B250 function within the /boafrm/formUploadFile endpoint, which implements the File Upload Handler. Attackers can manipulate the filename argument to traverse directories outside the intended upload path. The attack is executable remotely over the network and requires user interaction. A public exploit has been published, increasing the likelihood of opportunistic abuse against exposed devices.

Critical Impact
Remote attackers can write files to arbitrary locations on the router filesystem by abusing the filename parameter in /boafrm/formUploadFile, potentially overwriting configuration or executable files.

Affected Products

Totolink A3002MU router
Firmware version 1.0.0-B20230403.1455
File Upload Handler component (/boafrm/formUploadFile, function sub_44B250)

Discovery Timeline

2026-10-05 - CVE-2026-105286 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-105286

Vulnerability Analysis

The vulnerability exists in the firmware function sub_44B250, which processes multipart file upload requests sent to the /boafrm/formUploadFile endpoint on the embedded Boa web server. The handler extracts the filename field from the uploaded form data and uses it to construct a destination path on the device filesystem. Because the handler does not canonicalize or sanitize the supplied value, sequences such as ../ are preserved during path construction. The result is a classic directory traversal that lets a request escape the intended upload directory.

Successful exploitation lets attackers place attacker-controlled content at arbitrary filesystem locations writable by the web server process. On embedded routers this frequently includes configuration files, startup scripts, and web root content. The impact scope defined in the CVSS v4.0 vector is limited to the vulnerable component, with low confidentiality, integrity, and availability impact.

Root Cause

The root cause is missing input validation on the filename field inside sub_44B250. The function trusts the client-provided name and concatenates it into a destination path without stripping traversal sequences, enforcing a whitelist, or resolving the final path against an allowed base directory.

Attack Vector

An attacker sends a crafted HTTP POST request to /boafrm/formUploadFile with a multipart body whose filename parameter contains traversal sequences. Reaching the endpoint requires network access to the router's management interface and user interaction, per the CVSS vector UI:P. See the public proof-of-concept gist and the VulDB entry for CVE-2026-105286 for request-level details.

Detection Methods for CVE-2026-105286

Indicators of Compromise

HTTP POST requests to /boafrm/formUploadFile containing ../ or encoded variants (..%2f, ..%5c) in the filename field.
Unexpected files appearing in web-accessible or configuration directories on the router filesystem.
Modifications to startup scripts, /etc/ configuration files, or CGI binaries following administrative sessions.

Detection Strategies

Inspect router access logs and upstream proxy logs for POST requests to /boafrm/formUploadFile originating from unexpected sources or containing traversal patterns in multipart form data.
Deploy network IDS signatures that match multipart boundaries carrying filename=".. sequences destined for Totolink management interfaces.
Perform file integrity monitoring on firmware images and configuration backups to detect out-of-band modifications.

Monitoring Recommendations

Alert on any inbound WAN access to the router administrative interface, which should typically be restricted to LAN.
Correlate successful uploads with subsequent reboots, service restarts, or new outbound connections from the device.
Capture full packet traces of management-plane traffic for forensic review when traversal patterns are observed.

How to Mitigate CVE-2026-105286

Immediate Actions Required

Disable remote (WAN-side) administration on the Totolink A3002MU and restrict the web interface to trusted management VLANs.
Change the administrator password and audit the device for unexpected files, cron entries, or modified configurations.
Place vulnerable devices behind an access control list that only permits authenticated management hosts to reach /boafrm/* endpoints.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-105286. Monitor the TOTOLINK official site for firmware updates addressing the sub_44B250 handler in /boafrm/formUploadFile. If no fix is forthcoming, consider replacing the device.

Workarounds

Block external access to TCP ports hosting the router web UI at the perimeter firewall.
Use network segmentation to isolate management interfaces of SOHO routers from user workstations and servers.
Where supported, enforce HTTPS-only management with strong credentials and rate limiting on upload endpoints.

bash

# Example: restrict router admin interface to a trusted management subnet
# (apply on an upstream firewall; adjust interface and subnet to your environment)
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80  -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80  -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -j DROP