CVE-2026-93741CWE-119CWE-120

CVE-2026-93741

Critical · published September 19, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
EPSS
0.00657 · 50.8th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-09-19T10:16Z
References (6)
https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formWlWds.md · [email protected]https://vuldb.com/cve/CVE-2026-93741 · [email protected]https://vuldb.com/submit/914020 · [email protected]https://vuldb.com/vuln/407551 · [email protected]https://vuldb.com/vuln/407551/cti · [email protected]https://www.totolink.net/ · [email protected]
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 1%
    epss
  • 19 SEP 05:45Z
    Totolink A3002MU formWlWds buffer overflow
    cvelistv5