Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-105284: Totolink A3002MU can grant unauthorized access
CVE-2026-105284 · published 14 days ago
Summary
The Totolink A3002MU router has a flaw in its login check that could let someone bypass authentication. An attacker could exploit this from anywhere on the internet to gain access without proper credentials. Apply the latest firmware update from the vendor as soon as possible to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| totolink | a3002mu | 1.0.0-B20230403.1455 |
Original advisory text
Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-266Incorrect Privilege Assignment
CWE-285Improper Authorization
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Track software like this
Free during beta