EUVD-2026-42725
GHSA-f8vj-vmgj-67x6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Boa web interface remotely
-
DeliveryAuthenticate with low privileges
-
ExploitAbuse boa.conf least-privilege flaw
-
ExecutionEscalate access or read protected config
-
ImpactDisclose credentials/compromise device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Least privilege on resource access
|
| Exploitation Conditions | Exploitation requires network reachability to the Boa web interface AND a pre-existing low-privilege foothold on the device (CVSS PR:L) - it is not a remote-unauthenticated flaw. What limits exploitation: high attack complexity (AC:H) with VulDB explicitly stating exploitation 'is known to be difficult,' the requirement for at least low-level authenticated access to the web interface, and applicability limited to the seven listed TOTOLINK models running firmware up to 20260906. The specific trigger is functionality associated with the /etc/boa/boa.conf file of the Web Interface component; the exact configuration state or request needed is not detailed in available data (VulDB marks the affected functionality as 'unknown'). |
| Impact | Signals are mixed and lean toward moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:H/PR:L/UI:N) shows the flaw is network-reachable but requires existing low-level privileges AND high attack complexity, and VulDB explicitly states 'exploitation is known to be difficult' - a strong dampener despite the high VC/VI/VA impact metrics driving the 7.7 score. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not in CISA KEV and no proof-of-concept is referenced, so there is no evidence of active exploitation. Note a tension in the data: the CWE (CWE-272) and Tags ('Information Disclosure') point to a privilege/disclosure issue, yet the impact metrics assert full high confidentiality, integrity, and availability compromise - this breadth of impact should be verified against the vendor advisory, as VulDB-sourced impact scoring for obscure IoT flaws is often extrapolated rather than demonstrated. |
| Exploit ScenarioDerived | A low-privileged authenticated user (or an attacker who has obtained limited web-interface access) reaches the Boa web server over the network and abuses the least-privilege flaw tied to /etc/boa/boa.conf to read configuration/credential data or operate with elevated authority beyond their role. Because attack complexity is high and no public exploit exists, this realistically requires a skilled attacker with specific knowledge of the affected firmware rather than opportunistic mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Least-privilege violation across multiple TOTOLINK SOHO router models (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10, EX200 through firmware 20260906) stems from the /etc/boa/boa.conf configuration of the Boa web-server interface, allowing a low-privileged remote actor to gain access or information beyond their intended authorization boundary. The flaw carries CVSS 4.0 base score 7.7 with high attack complexity, and VulDB rates real-world exploitation as difficult. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis; the references point only to VulDB entries and submission records (https://vuldb.com/vuln/377214) rather than a fixed firmware release, so monitor https://www.totolink.net/ for a firmware update newer than 20260906 for the affected model. As compensating controls, restrict access to the router's web management interface to trusted management VLANs or hosts and disable remote/WAN-side administration so the Boa interface is not reachable from untrusted networks (trade-off: remote management convenience is lost); enforce strong, unique administrative credentials since exploitation requires low-privilege access (PR:L), reducing the pool of actors who can reach the vulnerable state; and where feasible tighten filesystem permissions/ownership on /etc/boa/boa.conf and segregate these consumer-grade devices behind a firewall. Given the difficulty of exploitation, network-level isolation is the highest-value control until firmware is available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Boa web server, a lightweight single-tasking HTTP server historically embedded in low-cost consumer/SOHO routers and IoT devices; its behavior is driven by the /etc/boa/boa.conf file referenced in this report. The root cause is classified as CWE-272 (Least Privilege Violation), meaning the web interface operates with, or grants, broader privileges than required - typically through misconfigured file ownership, permissive access-control directives, or an over-privileged CGI/service context defined in boa.conf. The CPE set (cpe:2.3:a:totolink:{a3000ru,a3100r,a950rg,ac1200t10,cp450,cs185r_t10,ex200}) confirms the issue spans seven distinct TOTOLINK product lines sharing the same Boa-based firmware codebase, indicating a common platform-level weakness rather than a model-specific bug.
Know when A3000Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable Boa interface but requires low-privilege access (PR:L) and difficult exploitation (AC:H); high C/I/A retained to match reported privilege-boundary impact, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult.
Executive ViewAI
A privilege escalation vulnerability in TOTOLINK SOHO routers (seven models, including A3000RU, A3100R, A950RG and others) threatens network access controls by enabling remote unauthorized access through network infrastructure devices. Without an available patch, organizations deploying these routers face elevated risk of network perimeter compromise and lateral movement, with no public mitigation timeline from the vendor.
Implement network segmentation to isolate affected routers from critical systems; restrict SSH and web management access to authorized admin IPs using firewall rules; enforce strong credentials and disable unnecessary services on router interfaces; enable and actively monitor router audit logs for unauthorized administrative access attempts; consider air-gapping affected devices if deployed in sensitive network locations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB