Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-105285: Totolink A3002MU allows remote code execution via QoS rule
CVE-2026-105285 · published 14 days ago
Summary
The router’s QoS rule handling can be tricked with crafted input, causing a memory overflow that lets an attacker run code from anywhere on the network. This could give the attacker control over the device. Install the latest firmware or any security update provided by Totolink as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| totolink | a3002mu | 1.0.0-B20230403.1455 |
Original advisory text
Totolink A3002MU QoS Rule formIpQoS stack-based overflow
A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_name leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-119Buffer Overflow
CWE-121Stack-based Buffer Overflow
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Track software like this
Free during beta