Description

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-19T09:16:34.740Z",
  "pubdate": "2026-09-19T09:16:34.740Z",
  "executiveSummary": "A critical command injection vulnerability exists in the Totolink A3002MU (firmware Hh-B20211125.1046) within the WSC (Wi-Fi Protected Setup) configuration interface.\nThe flaw stems from insufficient input validation in the 'localPin' argument processed by the 'formWsc' function in the file '/boafrm/formWsc'.\nThis vulnerability allows an unauthenticated remote attacker to execute arbitrary system commands with elevated privileges on the underlying operating system.\nThe presence of public exploit code increases the risk of exploitation by malicious actors.\nSuccessful exploitation compromises the confidentiality, integrity, and availability of the affected device, potentially leading to full system takeover and persistent unauthorized access within the local network.",
  "technicalDetails": "The vulnerability is located within the web management interface of the Totolink A3002MU, specifically in the component responsible for handling WSC settings. The '/boafrm/formWsc' file processes incoming HTTP POST requests directed at the WSC configuration handler. The 'formWsc' function fails to adequately sanitize or validate the 'localPin' parameter before passing it to system-level calls or shell interpreters.\nThe root cause is an improper neutralization of special elements used in an OS command. By injecting shell metacharacters (e.g., semicolons, backticks, or logical operators) into the 'localPin' field, an attacker can escape the intended input context and append arbitrary commands to be executed by the web server process.\nThe attack flow begins with a remote attacker sending a crafted HTTP request to the '/boafrm/formWsc' endpoint. The attacker includes a malicious payload within the 'localPin' parameter. Upon receiving this request, the backend function improperly handles the input, leading to the execution of the injected command by the underlying Linux-based firmware. Because the web server process often runs with high privileges (typically root), the injected command executes with those same privileges.\nThe attack is remotely exploitable and does not require pre-existing authentication to the administrative interface. The lack of sanitization in the 'formWsc' function creates a direct bridge between unauthenticated user input and system command execution. Once the command is injected, the attacker can achieve post-exploitation objectives, such as deploying persistent backdoors, pivoting into the internal network, intercepting traffic, or bricking the device.\nGiven that public proof-of-concept (PoC) code exists for this vulnerability, the complexity of crafting a functional exploit is significantly lowered. The vulnerability reflects a systemic failure in the sanitization routines within the firmware's web server CGI handler, specifically affecting firmware version Hh-B20211125.1046."
}