CVE-2026-15271CWE-266CWE-272

CVE-2026-15271

High · published July 10, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
52.8
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00706 · 52.8th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-272 · Least Privilege Violation
Published
2026-07-10T02:17Z
References (12)
https://vuldb.com/submit/852323 · [email protected]https://vuldb.com/vuln/377214 · [email protected]https://vuldb.com/vuln/377214/cti · [email protected]https://www.totolink.net/ · [email protected]https://vuldb.com/submit/852319 · [email protected]https://vuldb.com/submit/852320 · [email protected]https://vuldb.com/submit/852321 · [email protected]https://app.notion.com/p/A3000RU-V5-9c-5185-37a1f5ba989080d38bb6ca58b2a98c64?source=copy_link · [email protected]https://vuldb.com/cve/CVE-2026-15271 · [email protected]https://vuldb.com/submit/852316 · [email protected]https://vuldb.com/submit/852317 · [email protected]https://vuldb.com/submit/852318 · [email protected]
EPSS history
Timeline
  • 09 JUL 21:30Z
    TOTOLINK EX200 Web boa.conf least privilege violation
    cvelistv5