CVE-2026-93738CWE-119CWE-120

CVE-2026-93738

Critical · published September 19, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
57.9
In the wild
Unconfirmed
What it is

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
EPSS
0.00854 · 57.9th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-09-19T01:18Z
References (6)
https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formSchedule.md · [email protected]https://vuldb.com/cve/CVE-2026-93738 · [email protected]https://vuldb.com/submit/914017 · [email protected]https://vuldb.com/vuln/407548 · [email protected]https://vuldb.com/vuln/407548/cti · [email protected]https://www.totolink.net/ · [email protected]
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 1%
    epss
  • 18 SEP 21:00Z
    Totolink A3002MU formSchedule buffer overflow
    cvelistv5