Which versions of TOTOLINK Routers are affected by CVE-2026-15271?

A privilege escalation vulnerability in TOTOLINK SOHO routers (seven models, including A3000RU, A3100R, A950RG and others) threatens network access controls by enabling remote unauthorized access…

How to fix or mitigate CVE-2026-15271?

Within 24 hours: conduct asset inventory of all deployed TOTOLINK routers specifically models A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10, and EX200 running firmware version 20260906 or earlier. Within 7 days: restrict router management access to authorized administrators only, enable audit logging on affected devices, and implement network segmentation to isolate routers from sensitive infrastructure. Within 30 days: contact TOTOLINK support for patch availability and expected timeline; if no patch is forthcoming, begin procurement for replacement devices or alternate network architecture.

TOTOLINK Routers CVE-2026-15271

Q: What is the CVSS score of CVE-2026-15271?

CVE-2026-15271 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42725 HIGH

Least Privilege Violation (CWE-272)

2026-07-09 VulDB

GHSA-f8vj-vmgj-67x6

Information Disclosure A3000Ru A3100R A950Rg Ac1200T10 Cp450 Cs185R T10 Ex200

7.7

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable Boa interface but requires low-privilege access (PR:L) and difficult exploitation (AC:H); high C/I/A retained to match reported privilege-boundary impact, no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 22:07 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult.

AnalysisAI

Least-privilege violation across multiple TOTOLINK SOHO router models (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10, EX200 through firmware 20260906) stems from the /etc/boa/boa.conf configuration of the Boa web-server interface, allowing a low-privileged remote actor to gain access or information beyond their intended authorization boundary. The flaw carries CVSS 4.0 base score 7.7 with high attack complexity, and VulDB rates real-world exploitation as difficult. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Boa web server, a lightweight single-tasking HTTP server historically embedded in low-cost consumer/SOHO routers and IoT devices; its behavior is driven by the /etc/boa/boa.conf file referenced in this report. The root cause is classified as CWE-272 (Least Privilege Violation), meaning the web interface operates with, or grants, broader privileges than required - typically through misconfigured file ownership, permissive access-control directives, or an over-privileged CGI/service context defined in boa.conf. The CPE set (cpe:2.3:a:totolink:{a3000ru,a3100r,a950rg,ac1200t10,cp450,cs185r_t10,ex200}) confirms the issue spans seven distinct TOTOLINK product lines sharing the same Boa-based firmware codebase, indicating a common platform-level weakness rather than a model-specific bug.

RemediationAI

No vendor-released patch identified at time of analysis; the references point only to VulDB entries and submission records (https://vuldb.com/vuln/377214) rather than a fixed firmware release, so monitor https://www.totolink.net/ for a firmware update newer than 20260906 for the affected model. As compensating controls, restrict access to the router's web management interface to trusted management VLANs or hosts and disable remote/WAN-side administration so the Boa interface is not reachable from untrusted networks (trade-off: remote management convenience is lost); enforce strong, unique administrative credentials since exploitation requires low-privilege access (PR:L), reducing the pool of actors who can reach the vulnerable state; and where feasible tighten filesystem permissions/ownership on /etc/boa/boa.conf and segregate these consumer-grade devices behind a firewall. Given the difficulty of exploitation, network-level isolation is the highest-value control until firmware is available.