CVE-2026-105286: Path Traversal in Totolink A3002MU

This vulnerability in Totolink A3002MU 1.0.0-B20230403.1455 allows remote attackers to perform path traversal via manipulation of the filename argument in the file upload handler function sub_44B250 located at /boafrm/formUploadFile. This can potentially allow unauthorized access to files outside the intended directory. The vulnerability is remotely exploitable without privileges or user interaction, with limited impact on confidentiality, integrity, and availability. Public exploit code exists.

The vulnerability enables remote attackers to perform path traversal attacks, potentially accessing or overwriting files outside the intended upload directory. This can lead to information disclosure or modification of files, impacting system confidentiality and integrity. The CVSS score of 5.3 indicates a medium severity impact. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected device's management interface and monitor for suspicious activity related to file uploads.