TOTOLINK A3002MU: Improper authorization in web interface authentication check
Summary
The web administration interface of the TOTOLINK A3002MU router, firmware 1.0.0-B20230403.1455, contains an improper authorization flaw in the authentication check of the boa web server (function sub_40FCFC). According to the published research, the check can be bypassed so that a remote attacker can reach administrative functions without valid credentials. A public exploit is available, and the CISA SSVC assessment rates exploitation as PoC and automatable with total technical impact.
Affected
- TOTOLINK A3002MU, firmware 1.0.0-B20230403.1455
- Other firmware builds are not listed as affected, but this has not been verified.
Fixed in
Unknown. No vendor advisory or fixed firmware has been found.
Workaround
- Disable remote administration over WAN.
- Limit the web administration interface to a trusted management LAN or VLAN and block it at the perimeter.
Exploitation
- Public exploit available according to VulDB; CISA SSVC: exploitation PoC, automatable yes.
- Not marked as known exploited (KEV).
- In-the-wild exploitation: unknown.
Our recommendation
- Identify all TOTOLINK A3002MU devices and check the firmware string against 1.0.0-B20230403.1455.
- Disable WAN administration immediately and verify from outside the network that the admin interface is not reachable.
- Restrict admin access to a segregated management network.
- Monitor the TOTOLINK website and VulDB for a firmware update.
- Plan replacement with a device that receives regular security updates if no fix is released.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gist: TOTOLINK A3002MU authentication bypass in bin/boa gist.github.com
- VulDB: CVE-2026-105284 vuldb.com
- VulDB: vulnerability 413465 vuldb.com
- Strix: CVE-2026-105284 www.strix.ai
- TheHackerWire: CVE-2026-105284 www.thehackerwire.com
- HOL Guard: CVE-2026-105284 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:26.
Original description (NVD)
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.