CVE-2026-93738 is a buffer overflow vulnerability in the Totolink A3002MU Hh-B20211125.1046 device. It affects the formSchedule function located in the /boafrm/formSchedule file. An attacker can remotely trigger the vulnerability by manipulating the webpage argument, potentially leading to complete compromise due to the high CVSS score of 9.9. Public exploit code exists, increasing the risk of exploitation. No vendor advisory or patch information is provided in the input data.

Successful exploitation can lead to a complete compromise of confidentiality, integrity, and availability of the affected device. The vulnerability allows remote attackers to execute arbitrary code or cause denial of service via buffer overflow. The high CVSS score (9.9) reflects critical impact with network attack vector, low attack complexity, no user interaction, and privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting network access to the affected device and monitoring for exploit attempts. Follow vendor updates closely for official fixes.