Summary
generated automatically from NVD dataTotolink A3002MU firmware Hh-B20211125.1046 contains a buffer overflow in the formFilter function of /boafrm/formFilter, part of the boa component. Manipulating the ip6addr argument triggers the memory corruption (CWE-119), and the attack can be launched remotely. The NVD description notes that a public exploit is available, and the flaw carries a CVSS v3.1 score of 9.9 (CRITICAL).
NVD description
A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
EPSS · FIRST.org
0.85%probability of exploitation in the next 30 days
Higher than 57% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 14 sept. 2026
- Updated
- 15 sept. 2026
- Status
- Deferred
- Source
- cna@vuldb.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-119
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.