CVE-2026-26732
Published: 17 February 2026
Summary
CVE-2026-26732 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Totolink A3002Ru Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-26732 is a stack-based buffer overflow vulnerability (CWE-787, CWE-121) in the TOTOLINK A3002RU router running firmware version V2.1.1-B20211108.1455. The flaw occurs in the formFilter function when processing the vpnUser or vpnPassword parameters, allowing overflow conditions that can corrupt the stack.
The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low complexity and requiring only low privileges, such as those of an authenticated user. Exploitation enables an attacker to achieve high impacts on confidentiality, integrity, and availability, potentially leading to remote code execution on the affected device.
A proof-of-concept for the stack overflow is publicly available in a GitHub repository at https://github.com/0xmania/cve/tree/main/TOTOLINK-A3002RU-boa-formFilter-StackOverflow. No vendor advisories or patches are detailed in the CVE references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7829
Vulnerability details
TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPassword` parameters in the formFilter function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow in the router's formFilter function (processing web parameters) enables remote code execution via exploitation of a public-facing web application/service, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of vpnUser and vpnPassword inputs to prevent stack-based buffer overflows in the formFilter function.
Implements memory protections like stack canaries and non-executable stacks to mitigate exploitation of the buffer overflow vulnerability.
Mandates timely remediation of the identified stack buffer overflow flaw through firmware updates or mitigations.