CVE-2026-93738
9.9 CRITICALpublic exploit availablePublished 2026-09-18 · Updated 2026-09-22
AI risk analysis
- Summary
- The vulnerability in Totolink A3002MU Hh-B20211125.1046 allows for buffer overflow via the manipulation of the 'webpage' argument, leading to potential remote code execution.
- Exploitability
- Exploitation is relatively straightforward given the remote execution capability and public availability of the exploit.
- Blast radius
- If exploited, this could lead to complete control of the device, potentially affecting network security and data integrity.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to the fixed version 1.0.10 or later.
rcebuffer-overflowremoteweb
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-120
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-101074PoC
- HIGHCVE-2026-18897PoC
- CRITICALCVE-2026-94003PoC
- CRITICALCVE-2026-93741PoC
- CRITICALCVE-2026-101037PoC
- CRITICALCVE-2026-101038PoC
- CRITICALCVE-2026-101081PoC
- HIGHCVE-2026-18895PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.