Totolink A3002MU B20211125.1046 Router Faces High-Severity RCE

The National Vulnerability Database has disclosed a critical vulnerability, CVE-2026-6194, impacting the Totolink A3002MU B20211125.1046 router. This isn’t just a minor glitch; we’re talking about a stack-based buffer overflow stemming from improper handling of the wan-url argument within the sub_410188 function of the /boafrm/formWlanSetup component’s HTTP Request Handler.

What makes this particularly nasty is its remote exploitability. A threat actor doesn’t need physical access to the device; they can trigger this vulnerability over the network. With a CVSS score of 8.8 (HIGH), this flaw opens the door for significant compromise, potentially leading to full device control. The National Vulnerability Database also notes that an exploit has already been made public, meaning this isn’t some theoretical threat – it’s actively weaponizable.