CVE-2026-93742— Totolink A3002MU formWsc command injection
Quick assessment
Affected
Totolink A3002MU
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Totolink A3002MU Hh-B20211125.1046 中已发现一个弱点。受此问题影响的组件是文件 中的 函数。对参数 的操作会导致命令注入漏洞。该攻击可远程发起。相关的利用代码（exploit）已公开，可被用于发起攻击。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93742
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Totolink A3002MU formWsc command injection
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-93742
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93742
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-93742 (1)
-
🔗 VulDB | Security Check third-party-advisory
Proof of Concept for CVE-2026-93742 (1)
IV. Related Vulnerabilities
Same product: A3002MU
-
CVE-2026-93741
Totolink A3002MU formWlWds buffer overflow -
CVE-2026-93740
Totolink A3002MU formWlEncrypt buffer overflow -
CVE-2026-93739
Totolink A3002MU formWlAc buffer overflow -
CVE-2026-93738
Totolink A3002MU formSchedule buffer overflow -
CVE-2026-90608
Totolink A3002MU boa formPortFw buffer overflow
Same vendor: Totolink
-
CVE-2026-93741
Totolink A3002MU formWlWds buffer overflow -
CVE-2026-93740
Totolink A3002MU formWlEncrypt buffer overflow -
CVE-2026-93739
Totolink A3002MU formWlAc buffer overflow -
CVE-2026-93738
Totolink A3002MU formSchedule buffer overflow -
CVE-2026-91853
TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os comman
Same weakness: CWE-77
-
CVE-2026-93371
marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload -
CVE-2026-78501
Microsoft 365 Copilot Business Chat Information Disclosure V -
CVE-2026-85885
Microsoft 365 Copilot Elevation of Privilege Vulnerability -
CVE-2026-55946
Microsoft Copilot Information Disclosure Vulnerability -
CVE-2026-20176
Cisco Identity Services Engine Remote Code Execution Vulnera
V. Comments for CVE-2026-93742
No comments yet