Router flaw rated a 'perfect 10' — but only if you own this one obscure TOTOLINK model

A newly published vulnerability tracker entry, CVE-2026-93741, has been rated critical, with reports pegging its CVSS score at the maximum possible 10. That sounds like the kind of thing that should have every home network in Britain on lockdown. It isn’t. Read past the scary number and the bug turns out to live in one specific, fairly obscure piece of consumer networking kit.

What the bug actually does

According to the NVD listing and a technical write-up posted on GitHub, the flaw sits in the firmware of the TOTOLINK A3002MU, an AC1200 “giga” wireless router, running firmware version Hh-B20211125.1046.

The problem is in the router’s built-in web management server (/bin/boa), specifically a function called formWlWds that’s reached via the /boafrm/formWlWds endpoint. That function handles a parameter named submit-url without properly checking how long the incoming data is. Send it an oversized value in a crafted HTTP request, and you get a classic buffer overflow — the kind of memory-handling error that’s been causing headaches in embedded devices for decades.

The GitHub researcher’s write-up states plainly that successful exploitation “may cause a denial-of-service condition” — in other words, the router could crash or become unresponsive. Buffer overflows can sometimes be escalated further, but nothing in the published material confirms that this one has been shown to allow remote code execution, data theft or a full device takeover. Nor is there any evidence, in what’s been disclosed so far, that the bug is being actively exploited in the wild.

So who is actually at risk

Only people running this exact device, on this exact firmware version, are in scope. If you don’t own a TOTOLINK A3002MU, this vulnerability simply doesn’t apply to you.

Even for A3002MU owners, the practical risk hinges on details that remain unclear. The vulnerability appears to require an attacker to reach the router’s web management interface — normally something exposed on a home network, not the open internet, unless remote administration has been switched on. There’s no public confirmation yet of exactly how easy the attack is to pull off from outside the local network, how many of these routers are actually in use, or — crucially — whether TOTOLINK has issued a patch. None of the sources cited here answer that last question, which is the one that matters most.

A CVSS score of 10 reflects a model of worst-case severity — how bad things could theoretically get — not proof of how bad things actually are for a typical user. Treat the headline number as a starting point for scrutiny, not a verdict.

What to do about it

If you own a TOTOLINK A3002MU, check the vendor’s support site for a firmware update and install it if one exists. In the meantime, make sure the router’s remote management feature is switched off, and that its administration panel isn’t reachable from outside your home network — good practice for any router, regardless of this bug. If you’re not sure what router you have, it’s worth a quick check of the settings page, if only for peace of mind.

For everyone else, this is one to file under “noted, not needed.” Critical-sounding CVEs get published regularly for niche IoT devices, and most of Britain’s broadband customers won’t be running the kit in question. The sensible response is to keep router firmware updated generally, rather than to panic over a score attached to a single, fairly niche product.