CVE-2026-93741: Totolink A3002MU Buffer Overflow Vulnerability

CVE-2026-93741 Overview

CVE-2026-93741 is a buffer overflow vulnerability affecting the Totolink A3002MU router running firmware version Hh-B20211125.1046. The flaw resides in the formWlWds function within the /boafrm/formWlWds endpoint of the device's web management interface. Attackers can trigger the overflow by manipulating the submit-url parameter. The vulnerability is exploitable remotely over the network without authentication or user interaction. Public exploit details have been released, increasing the likelihood of opportunistic attacks against exposed devices. The weakness is categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Unauthenticated remote attackers can corrupt memory on affected Totolink A3002MU routers, potentially achieving arbitrary code execution and full device takeover.

Affected Products

Totolink A3002MU router
Firmware version Hh-B20211125.1046
Web management interface component /boafrm/formWlWds

Discovery Timeline

2026-09-19 - CVE-2026-93741 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93741

Vulnerability Analysis

The vulnerability affects the formWlWds handler in the Boa-based web server used by the Totolink A3002MU router. This handler processes wireless WDS (Wireless Distribution System) configuration requests submitted through the device's administrative interface. When the handler processes the submit-url parameter, it fails to validate the length of the incoming data before copying it into a fixed-size buffer. Attackers can send an oversized value in the submit-url argument to overflow the destination buffer and corrupt adjacent memory. Because the router's HTTP service is directly reachable over the network, exploitation does not require prior authentication.

Root Cause

The root cause is an unchecked memory operation within the formWlWds function, aligned with [CWE-119]. The function accepts attacker-controlled input from the submit-url query parameter and writes it into a stack or heap buffer without enforcing bounds. This missing length check allows attackers to overwrite return addresses, function pointers, or adjacent structures. Embedded MIPS-based devices such as the A3002MU typically lack modern memory protections such as ASLR and stack canaries, which increases exploitability.

Attack Vector

Exploitation occurs remotely by issuing a crafted HTTP request to the /boafrm/formWlWds endpoint with an oversized submit-url value. No credentials or user interaction are required. Successful exploitation may cause a denial of service through router crash or enable arbitrary code execution with the privileges of the web server process, which typically runs as root on this class of device. Public proof-of-concept documentation is available in the GitHub PoC Documentation and the VulDB CVE-2026-93741 Entry.

Detection Methods for CVE-2026-93741

Indicators of Compromise

HTTP POST or GET requests to /boafrm/formWlWds containing unusually long submit-url parameter values.
Repeated router reboots, web interface crashes, or watchdog resets following inbound HTTP traffic to the management port.
Outbound connections from the router to unfamiliar hosts following administrative traffic bursts.

Detection Strategies

Inspect web server logs on the router for requests targeting /boafrm/formWlWds and flag requests where the submit-url parameter exceeds expected length thresholds.
Deploy network IDS signatures that match oversized parameter values in HTTP requests to Boa-based embedded management interfaces.
Correlate router availability events with inbound HTTP traffic patterns to identify overflow-induced crashes.

Monitoring Recommendations

Monitor perimeter firewalls and NetFlow data for external access attempts to router administrative interfaces on ports 80 and 443.
Alert on any exposure of consumer or SOHO router management interfaces to the public internet.
Track vendor advisories from Totolink for firmware updates addressing the formWlWds handler.

How to Mitigate CVE-2026-93741

Immediate Actions Required

Restrict access to the router's web management interface to trusted internal networks only and block WAN-side administrative access.
Disable remote management features if they are not required for operations.
Segment the affected devices from sensitive network resources until a patch is applied.

Patch Information

At the time of publication, no vendor-supplied patch was referenced in the NVD data for the Totolink A3002MU running firmware Hh-B20211125.1046. Administrators should monitor the Totolink Official Website for firmware updates that remediate the formWlWds handler. If a fixed firmware release becomes available, apply it promptly and verify the version after upgrade.

Workarounds

Place the router behind an upstream firewall or ACL that blocks unauthenticated access to /boafrm/formWlWds.
Replace end-of-life or unsupported Totolink A3002MU units with actively supported hardware where firmware fixes are not forthcoming.
Change default administrative credentials and enforce strong passwords to reduce follow-on abuse if the device is partially compromised.

bash

# Example upstream firewall rule to block external access to the router management interface
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -m state --state NEW -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -m state --state NEW -j DROP