Critical severity · published Sep 18, 2026
CVE-2026-93738
Totolink A3002MU formSchedule buffer overflow
9.9
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A3
A3002MU · Totolink
Hh-B20211125.1046 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93738
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93738
github.com
https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formSchedule.md
vuldb.com
https://vuldb.com/cve/CVE-2026-93738
vuldb.com
https://vuldb.com/submit/914017
vuldb.com
https://vuldb.com/vuln/407548
vuldb.com
https://vuldb.com/vuln/407548/cti
www.totolink.net
https://www.totolink.net/
More from A3002MU
10.0
CVE-2026-105285
Totolink A3002MU QoS Rule formIpQoS stack-based overflow
10.0
CVE-2026-105284
Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization
10.0
CVE-2026-93741
Totolink A3002MU formWlWds buffer overflow
10.0
CVE-2026-93740
Totolink A3002MU formWlEncrypt buffer overflow
9.9
CVE-2026-93742
Totolink A3002MU formWsc command injection