CVE-2026-105286: Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal
A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be executed remotely and requires no privileges, but it does require user interaction according to the supplied severity vector. Exploitation targets the filename argument handled by the file upload endpoint.
Which device version is identified as affected?
The affected product identified in the available data is Totolink A3002MU version 1.0.0-B20230403.1455.
How likely is exploitation in practice?
A public exploit is available and may be used. The supplied vector rates attack complexity as low, so defenders should treat exposed affected devices as actionable.