CVE-2026-93742
9.9 CRITICALpublic exploit availablePublished 2026-09-19 · Updated 2026-09-21
AI risk analysis
- Summary
- The flaw allows command injection via the localPin argument in the formWsc function, enabling remote attackers to execute arbitrary commands on the device.
- Exploitability
- Exploitation is relatively straightforward given the public availability of an exploit. Remote attackers need only manipulate the localPin argument to initiate the attack.
- Blast radius
- If exploited, this vulnerability could lead to full device compromise, including potential data theft and control of the device.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to the fixed version 1.0.2 or later.
rcecommand-injectionremotepatch-available
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-74, CWE-77
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-101008PoC
- CRITICALCVE-2026-101187PoC
- CRITICALCVE-2026-101260PoC
- CRITICALCVE-2026-101263PoC
- CRITICALCVE-2026-102792PoC
- CRITICALCVE-2026-102793PoC
- HIGHCVE-2026-18787PoC
- CRITICALCVE-2026-94096
Related by shared AI tags and CWE weakness class. Browse the full archive.