CVE-2026-105284: Improper Authorization in Totolink A3002MU

The vulnerability CVE-2026-105284 exists in the Totolink A3002MU router firmware version 1.0.0-B20230403.1455. It is located in the function sub_40FCFC within the /bin/boa executable, which handles authentication checks. Due to improper authorization logic, remote attackers can manipulate the function to gain unauthorized access or perform actions without proper permissions. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impacts on confidentiality, integrity, and availability. Public exploit code is available, but no information about active exploitation in the wild or vendor patches is provided.

Successful exploitation of this vulnerability allows remote attackers to bypass authentication and authorization mechanisms on the affected Totolink A3002MU device. This can lead to full compromise of the device, including unauthorized access to sensitive information, configuration changes, or disruption of service. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no vendor patch or official fix information is provided, users should monitor Totolink's official channels for updates. Until a fix is available, restricting network access to the device's management interface and disabling remote administration where possible are recommended to reduce exposure.