What is CVE-2026-105284?

CVE-2026-105284 is a critical-severity vulnerability in Totolink A3002mu, classified under Incorrect Privilege Assignment. CVSS score: 10.0/10. Published 2026-10-05.

How severe is CVE-2026-105284?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Auth bypass in Totolink A3002mu

CVE-2026-105284

A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Published 2026-10-05 · last modified 2026-10-05.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Totolink A3002mu — versions 1.0.0-B20230403.1455

Weakness classification (CWE)

References

gist.github.com/H3rmesk1t/ac6e91a8fba51002be085755c8bf7d43 (exploit)
vuldb.com/cve/CVE-2026-105284 (third-party-advisory)
vuldb.com/submit/977217 (third-party-advisory)
vuldb.com/vuln/413465 (technical-description, vdb-entry)
vuldb.com/vuln/413465/cti (signature, permissions-required)
www.totolink.net/ (product)

Frequently asked questions

What is CVE-2026-105284?: CVE-2026-105284 is a critical-severity vulnerability in Totolink A3002mu, classified under Incorrect Privilege Assignment. CVSS score: 10.0/10. Published 2026-10-05.
How severe is CVE-2026-105284?: Critical severity. CVSS v3 base score is 10.0 out of 10.