CVE-2026-93742

9.9 CRITICALpublic exploit available

Published 2026-09-19 · Updated 2026-09-21

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-74, CWE-77

Public exploit & PoC references

https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/rce-formWsc.md

All references

https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/rce-formWsc.md
https://vuldb.com/cve/CVE-2026-93742
https://vuldb.com/submit/914021
https://vuldb.com/vuln/407552
https://vuldb.com/vuln/407552/cti
https://www.totolink.net/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-18787PoC
HIGHCVE-2026-18811PoC
HIGHCVE-2026-18812PoC
HIGHCVE-2026-18813PoC
HIGHCVE-2026-18814PoC
HIGHCVE-2026-18902PoC
MEDIUMCVE-2026-93965PoC
MEDIUMCVE-2026-93966PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.