Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-105286: Totolink A3002MU lets attackers place files anywhere
CVE-2026-105286 · published 14 days ago
Summary
The file‑upload feature on the Totolink A3002MU router allows a specially crafted file name to move outside the intended folder, letting an attacker write files to arbitrary locations on the device. This can be triggered over the network and could lead to unauthorized code running or the router being taken over. Install the latest firmware from the vendor and, if possible, restrict or monitor file‑upload functions until the fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| totolink | a3002mu | 1.0.0-B20230403.1455 |
Original advisory text
Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal
A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit is now public and may be used.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-22Path Traversal
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Track software like this
Free during beta