CVE-2026-93742

Name of the Vulnerable Software and Affected Versions Totolink A3002MU version Hh-B20211125.1046

Description Remote command injection is possible due to improper handling of the localPin argument within the formWsc() function located in the /boafrm/formWsc file. This allows a remote attacker to execute arbitrary commands on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the formWsc() function to minimize the risk of exploitation.