CRITICAL

CVE-2026-93742

2026-09-19 CVSS v3.1

CVSS

9.9

Description

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Weakness (CWE)

CWE-74 Injection

CWE-77 Command Injection

EPSS Score

1.88%

Probability of exploitation in next 30 days

78.5th percentile

References

https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/rce-formWsc.md https://vuldb.com/cve/CVE-2026-93742 https://vuldb.com/submit/914021 https://vuldb.com/vuln/407552 https://vuldb.com/vuln/407552/cti https://www.totolink.net/

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE