EUVD-2026-77141
GHSA-gxv2-393q-4j5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain router web UI credentials
-
DeliverySend crafted HTTP POST to /boafrm/formIpv6Setup
-
ExploitOverflow static_ipv6 buffer in boa handler
-
ExecutionOverwrite saved return address
-
ImpactExecute arbitrary code as root on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires low-privilege authenticated access to the Totolink A3002MU web management interface (CVSS PR:L), meaning valid router credentials are a prerequisite. The device must run firmware Hh-B20211125.1046; other firmware versions may also be affected but are not confirmed. The IPv6 static configuration feature must be reachable via the web UI (enabled by default in most firmware builds). Exploitation is limited by: (1) required authentication - attacker must possess or brute-force router credentials; (2) typical LAN-side-only exposure of router management - if WAN management is disabled, exploitation is restricted to attackers already on the local network; (3) specific firmware version confirmed, though broader impact is plausible. No special network conditions, race conditions, or timing requirements are indicated (AC:L, AT:N). |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms the vulnerability is network-accessible with low complexity, requiring only low-privilege authentication - typical web UI credentials. The E:P supplemental metric in the provided vector confirms a public proof-of-concept exists, raising the practical exploitation probability above theoretical. The impact metrics (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflect both full device compromise and downstream network impact through a compromised router acting as a network pivot point. No KEV listing exists, meaning active exploitation in the wild is not confirmed by CISA, and no EPSS score was supplied in the intelligence data. However, the combination of a public PoC, AC:L, and the fact that many consumer routers expose management interfaces on the LAN (and sometimes WAN) means even a mid-sized municipal IT team in sanok should treat this as urgent if Totolink A3002MU units are deployed in their network edge. The authentication requirement (PR:L) is the primary limiting factor, though default or weak router credentials are common in SOHO deployments and easily satisfied. |
| Exploit ScenarioDerived | An attacker who has obtained router web UI credentials - through credential stuffing against default admin/admin credentials, phishing, or LAN-side access - sends a crafted HTTP POST request to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 14, 2026
Remote buffer overflow in the Totolink A3002MU router's boa web server allows authenticated network attackers to overflow a fixed-size buffer in the formIpv6Setup handler by supplying an oversized static_ipv6 argument, potentially enabling arbitrary code execution with root privileges on the device. The vulnerability affects firmware version Hh-B20211125.1046 and a proof-of-concept exploit has been publicly disclosed to GitHub. No vendor-released patch has been identified in available references at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis - no fix version appears in any available reference or advisory. Immediately restrict access to the router's web management interface to trusted administrative hosts only and disable WAN-side management access if enabled, which eliminates the primary remote attack surface (note: this does not protect against LAN-based insiders with credentials). If IPv6 static configuration is not required in the deployment, disabling IPv6 on the device removes the vulnerable code path entirely at the cost of IPv6 connectivity. Check https://www.totolink.net/ regularly for firmware updates and apply any released update immediately. Given the lack of a confirmed patch and the public PoC, organizations should evaluate replacing end-of-support Totolink A3002MU units with actively maintained alternatives. The VulDB entry at https://vuldb.com/vuln/403188 should be monitored for patch updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Totolink A3002MU is a consumer-grade wireless router whose web management interface runs on boa, a minimal single-threaded embedded HTTP server widely used in IoT and SOHO router firmware. The vulnerable endpoint /boafrm/formIpv6Setup handles HTTP POST submissions for static IPv6 address configuration. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates the formIpv6Setup function performs an unchecked copy of the user-supplied static_ipv6 parameter into a fixed-size buffer, with no bounds validation. Embedded boa implementations in consumer routers typically lack modern exploit mitigations such as stack canaries, ASLR, or NX enforcement, making buffer overflows highly exploitable. The firmware identifier Hh-B20211125.1046 is MIPS-based, consistent with the router's hardware profile.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Low-privilege authentication required for web UI; AC:L due to public PoC and no special conditions; S:C reflects network pivot potential via fully compromised router.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static_ipv6 leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
The Totolink A3002MU router contains a remote code execution vulnerability with publicly available exploit code, allowing an authenticated attacker to gain root-level control of the device. Organizations deploying these routers face potential complete compromise of their network security perimeter, enabling lateral movement across internal systems and persistent backdoor installation. Immediately inventory deployments, restrict management access, and assume adversaries have access to exploit tooling.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the router's web management interface (port 80/443) using firewall rules, disable remote management features if enabled, implement network segmentation to isolate the router from high-value systems, deploy intrusion detection rules to monitor for exploitation attempts targeting IPv6 configuration endpoints, and consider temporary replacement with alternative network equipment if patches remain unavailable beyond 30 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB