Is CVE-2026-93739 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93739 being exploited in the wild.

How severe is CVE-2026-93739?

Critical severity, with a CVSS score of 9.9, published 18 September 2026.

Which products and versions are affected?

TOTOLINK A3002MU Hh-B20211125.1046.

Is there a fix for CVE-2026-93739?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93739 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-93739?

Check whether you run TOTOLINK A3002MU at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93739: Totolink A3002MU buffer overflow in formWlAc

CVE-2026-93739 · Severity: critical · CVSS 9.9 · Published 2026-09-18

The Totolink A3002MU wireless router contains a buffer overflow vulnerability in its web-based management interface. An attacker can send a specially crafted HTTP request with an oversized parameter to the router's configuration form, causing the web server process to crash and making the router's management interface inaccessible. This results in a denial-of-service condition that prevents administrators from accessing the router remotely.

Technologies: TOTOLINK A3002MU. Vendors: TOTOLINK.

Quick answers

Is CVE-2026-93739 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93739 being exploited in the wild.
How severe is CVE-2026-93739?: Critical severity, with a CVSS score of 9.9, published 18 September 2026.
Which products and versions are affected?: TOTOLINK A3002MU Hh-B20211125.1046.
Is there a fix for CVE-2026-93739?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93739 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-93739?: Check whether you run TOTOLINK A3002MU at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer overflow exists in the /bin/boa web server's formWlAc function when processing the submit-url POST parameter. The vulnerable code performs unsafe string copying without proper length validation, allowing an attacker to overwrite adjacent memory by sending an HTTP POST request with an excessively long submit-url value. This results in a crash of the Boa process, causing denial of service.

Affected products

Totolink A3002MU Hh-B20211125.1046

Timeline

2026-09-18: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.