CVE-2026-36837
Published: 29 April 2026
Summary
CVE-2026-36837 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-36837 is a stack-based buffer overflow vulnerability affecting the TOTOLINK A3002RU V3 router in versions up to V3.0.0-B20220304.1804. The flaw exists in the formMapDelDevice function, triggered by the hostname parameter, and is classified under CWE-121. It was published on 2026-04-29 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An unauthenticated remote attacker with network access to the device can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation causes a stack-based buffer overflow, resulting in a denial-of-service condition through application crash or disruption, with high availability impact but no confidentiality or integrity effects.
References point to GitHub repositories at https://github.com/0xmania/cve/tree/main/TOTOLINK-A3002RUV3.0-boa-formMapDelDevice-StackOverflow, which contain details and likely proof-of-concept code demonstrating the stack overflow in the TOTOLINK A3002RU V3.0 boa-formMapDelDevice component. No vendor advisories, patches, or specific mitigation guidance are provided in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26230
Vulnerability details
TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the hostname parameter in the formMapDelDevice function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack buffer overflow in public-facing router web function causes application crash/DoS with no C/I impact, directly enabling T1499.004 Application or System Exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack-based buffer overflow flaw in the formMapDelDevice function through identification, reporting, and correction.
Validates the hostname parameter to prevent the stack-based buffer overflow triggered by malformed input.
Implements memory safeguards like stack canaries to protect against stack-based buffer overflow exploitation leading to crashes.