What is the CVSS score of CVE-2026-26736?

CVE-2026-26736 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of A3002ru Firmware are affected by CVE-2026-26736?

A critical buffer overflow vulnerability affects TOTOLIK A3002RU_V3 routers, allowing remote attackers to execute arbitrary code with high probability of success.

Is there a public PoC exploit available for CVE-2026-26736?

Yes, a public proof-of-concept exploit is available for CVE-2026-26736. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-26736?

Within 24 hours: Inventory all TOTOLINK A3002RU_V3 devices in production and isolate or restrict network access if possible. Within 7 days: Implement network segmentation to limit router access to trusted administrative sources only, disable IPv6 configuration interfaces if not required, and monitor for exploitation attempts. Within 30 days: Plan replacement or migration to an alternative router vendor with active security support, as no patch timeline is available from TOTOLINK.

A3002ru Firmware CVE-2026-26736

HIGH

Out-of-bounds Write (CWE-787)

2026-02-17 cve@mitre.org

Buffer Overflow Stack Overflow A3002ru Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 09, 2026 - 17:16 vuln.today

Public exploit code

CVE Published

Feb 17, 2026 - 19:21 nvd

HIGH 8.8

DescriptionCVE.org

TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function.

AnalysisAI

Stack-based buffer overflow in TOTOLIK A3002RU firmware versions up to V3.0.0-B20220304.1804 allows authenticated attackers to achieve remote code execution through a malicious static_ipv6 parameter. Public exploit code exists for this vulnerability, and no patch is currently available. The high CVSS score of 8.8 reflects the complete compromise of system confidentiality, integrity, and availability for affected devices.

Technical ContextAI

Classified as CWE-787 (Out-of-bounds Write). Affects the static_ipv6 component of A3002Ru Firmware. TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.