A3002Mu CVE-2026-6194

Authenticated access to the Totolink A3002MU web management interface at /boafrm/formWlanSetup is required. The attacker must possess valid low-privileged credentials (PR:L) to the router's administrative panel. This typically requires either network-level access to reach the management interface (local LAN connectivity or exposed remote administration port) plus knowledge of administrator credentials. The vulnerability is exploitable against the specific firmware version B20211125.1046 of the A3002MU product when the WLAN setup configuration interface is accessible to authenticated users.

Real-world risk is moderate despite the high CVSS v4.0 score of 7.4. Multiple risk signals provide nuanced context: CVSS vector shows network-accessible attack (AV:N) with low complexity (AC:L) but requires low-privileged authentication (PR:L), preventing anonymous internet exploitation. SSVC framework rates this as having total technical impact but not automatable, requiring authenticated access to the router's management interface. EPSS probability of 0.08% (23rd percentile) indicates minimal observed exploitation activity in the wild, consistent with a vulnerability in legacy consumer networking equipment with limited deployment scale. The vulnerability is NOT in CISA KEV, confirming no confirmed active exploitation campaigns. While public exploit code exists (GitHub PoC), the authentication requirement and specificity to a single firmware version of a niche router product substantially limit attack surface. This is a legitimate vulnerability requiring remediation for affected deployments, but not a tier-1 priority compared to unauthenticated remote code execution vulnerabilities or those with confirmed active exploitation.

An attacker with valid credentials to the router's web management interface (obtained through credential theft, default password reuse, or social engineering) connects to the administrative panel over the local network or via exposed remote management ports. The attacker sends a specially crafted HTTP request to /boafrm/formWlanSetup containing an oversized 'wan-url' parameter exceeding the fixed stack buffer in function sub_410188. The overflow overwrites the stack return address, redirecting execution to attacker-controlled shellcode embedded in the request payload, achieving arbitrary code execution with router firmware privileges and enabling full device compromise.