CVE-2026-105286
Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 5, 2026
- Updated
- Oct 7, 2026
- Reserved
- Oct 4, 2026
Description
A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit is now public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
A3002MUTotolink |
|
References
- VDB-413467 | Totolink A3002MU File Upload formUploadFile sub_44B250 path traversalvdb-entrytechnical-description
- VDB-413467 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-105286 | CVE Analysis and Reportthird-party-advisory
- Submit #977225 | TOTOLINK A3002MU V1.0.0-B20230403.1455 Path Traversalthird-party-advisory
- https://gist.github.com/H3rmesk1t/b107cde70392e0aff26e8219bae1a181exploit
- https://www.totolink.net/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.