CVE-2026-105285: Totolink a3002mu

Critical severity, CVSS 10.0. EPSS: 0.6% chance of exploitation in the next 30 days.

A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_name leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Affected products

• Totolink a3002mu: version 1.0.0-B20230403.1455 only

Published 2026-10-05. Last modified 2026-10-06.