← Vulnerability feed

Vulnerability record · CVE-2026-26736 · published 17 February 2026

CVE-2026-26736: Totolink a3002ru firmware out-of-bounds write vulnerability

TTotolink · A3002ru Firmware

TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function.

8.8 CVSS 3.1 High EPSS 1.3% · top 29.8% CWE-787 · Out-of-bounds writeCWE-121 · Stack-based buffer overflow
8.8CVSS 3.1 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/0xmania/cve/tree/main/TOTOLINK-A3002RUV3.0-boa-formIpv6Setup-StackOverflow ExploitThird Party Advisory

Track CVE-2026-26736 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-34198Totolink a3002ru firmware classic buffer overflow vulnerabilityTOTOLINK AC1200 Wireless Router A3002RU V2.1.1-B20230720.1011 is vulnerable to Buffer Overflow. The formWlEncrypt CGI handler in the boa program fail…EPSS 0.66%9.8CVE-2022-35491Totolink a3002ru firmware hard-coded credentials vulnerabilityTOTOLINK A3002RU V3.0.0-B20220304.1804 has a hardcoded password for root in /etc/shadow.sample.EPSS 0.82%9.8CVE-2019-19825Totolink a3002ru firmware improper authentication vulnerabilityOn certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin…EPSS 30%9.8CVE-2018-13306Totolink a3002ru firmware os command injection vulnerabilitySystem command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter.EPSS 3.2%9.8CVE-2018-13307Totolink a3002ru firmware os command injection vulnerabilitySystem command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST paramet…EPSS 3.2%9.8CVE-2018-13314Totolink a3002ru firmware os command injection vulnerabilitySystem command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter.EPSS 3.2%9.8CVE-2018-13316Totolink a3002ru firmware os command injection vulnerabilitySystem command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter.EPSS 3.2%9.8CVE-2018-13311Totolink a3002ru firmware os command injection vulnerabilitySystem command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter.EPSS 2.5%

Source: NIST National Vulnerability Database (record CVE-2026-26736), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.