TOTOLINK A3002MU: Stack-based buffer overflow in QoS rule handler
Summary
A stack-based buffer overflow in the QoS rule handler of the web management interface (/boafrm/formIpQoS) of the TOTOLINK A3002MU router allows remote exploitation. The vulnerable parameters comment and entry_name are copied into a fixed-size stack buffer without a length check. An attacker can crash the management interface or potentially execute code, and a public exploit has been disclosed. The official CVE record rates the issue 9.3 (CVSS v4.0, critical); the sources differ on whether authentication is required.
Affected
- TOTOLINK A3002MU, firmware 1.0.0-B20230403.1455
- Other firmware versions: unknown
Fixed in
Unknown. No fixed firmware version has been published as of the sources reviewed.
Workaround
- Disable remote (WAN-side) administration of the device.
- Restrict access to the web management interface to trusted internal addresses only.
- Monitor web server logs for unusually long values in QoS-related parameters.
Exploitation
- A public exploit has been disclosed (VulDB, CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total).
- No known exploitation in the wild has been reported in the sources reviewed.
Our recommendation
- Inventory all TOTOLINK A3002MU devices and check the firmware version.
- Remove any internet exposure of the web management interface immediately.
- Contact TOTOLINK for a fix and monitor https://www.totolink.net/ for advisories.
- If no fix is available, replace the device with a model that receives security updates.
- Review logs for signs of compromise on exposed devices.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gist: TOTOLINK A3002MU stack buffer overflow write-up gist.github.com
- VulDB: CVE-2026-105285 vuldb.com
- VulDB: vulnerability 413466 vuldb.com
- VulDB: submission 977224 vuldb.com
- TOTOLINK website www.totolink.net
- TheHackerWire: CVE-2026-105285 www.thehackerwire.com
- HOL Guard: CVE-2026-105285 hol.org
- Sploitus: CVE-2026-105285 sploitus.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:26.
Original description (NVD)
A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_name leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.