CVE-2026-105285

Executive Summary

CVE-2026-105285 is a critical stack-based buffer overflow in the TOTOLINK A3002MU router (firmware version 1.0.0-B20230403.1455), reachable through the QoS Rule Handler at /boafrm/formIpQoS. Manipulation of the addQos, comment, or entry_name arguments drives an out-of-bounds write that can corrupt stack memory, with remote exploitation possible and no authentication or user interaction required per the CVSS vector. The exploit has been publicly disclosed, and the device remains unpatched — successful exploitation can grant a remote, unauthenticated attacker full control of the affected device, yielding a CVSS base score of 10.0.

Technical Analysis

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and manifests as a stack-based buffer overflow. The affected component is the QoS Rule Handler implemented in the file /boafrm/formIpQoS. According to the NVD description, "an unknown function" of this file processes the arguments addQos, comment, and entry_name, and "the manipulation" of these arguments leads to the overflow.

At a code level, a stack-based buffer overflow occurs when input data is copied into a fixed-size stack buffer without adequate bounds checking. The size or content of the attacker-controlled argument exceeds the allocated buffer, overwriting adjacent stack memory — including saved frame pointers and the return address. Because the description explicitly names addQos, comment, and entry_name as the manipulated arguments, these represent the primary attacker-controlled input vectors into the vulnerable handler. The overflow is described as reachable remotely and exploitable without authentication (AV:N, PR:N, UI:N), indicating that the HTTP endpoint /boafrm/formIpQoS accepts these parameters over the network prior to any credential check, or that the QoS rule submission path is reachable pre-authentication.

The CVSS scope is marked Changed (S:C), meaning a successful exploit can impact resources beyond the vulnerable component's security scope — consistent with full device compromise where the router's embedded operating system and any trusted downstream network segment are affected. Confidentiality, Integrity, and Availability impacts are all rated High (C:H/I:H/A:H). No further implementation detail (exact buffer size, copy function, or offset) is provided in the source data, and none should be assumed.

The device is an end-of-life-class consumer/SMB router; the firmware build dated 20230403 indicates a 2023 release, and no vendor fix has been published, leaving the full install base of this specific build exposed.

Exploitation Scenarios

No public PoC code is included in the provided data; however, the NVD description states the exploit "has been disclosed publicly and may be used." The following attack chain describes the vulnerability class and is consistent with a remote, unauthenticated stack overflow.

1. Reconnaissance / target identification. An attacker identifies internet-exposed TOTOLINK A3002MU devices, e.g., via Shodan-style queries matching the product/management interface or the /boafrm/ administrative path. Reachability of the HTTP management interface on the WAN or LAN is the prerequisite.
2. Triggering the flaw. The attacker sends an HTTP request to /boafrm/formIpQoS containing the QoS rule parameters addQos, comment, and/or entry_name. One of these fields is populated with an oversized value that exceeds the destination stack buffer in the QoS Rule Handler, causing the out-of-bounds write. No authentication is required per the CVSS vector.
3. Payload / execution (class level). Because the overwrite targets stack memory, the attacker's objective is to overwrite control-flow data (such as the saved return address) to redirect execution to attacker-influenced data. The precise offset and copy routine are not disclosed in the source data and are not fabricated here. The publicly disclosed exploit would carry the concrete byte layout.
4. Post-exploitation impact. Successful exploitation gives the attacker code execution in the context of the router's web/QoS service — typically root or a privileged embedded process — resulting in full device compromise, persistent reconfiguration, traffic interception, or use of the device as a pivot into the internal network.

Impact Assessment

With a CVSS base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the impact is maximal. An unauthenticated remote attacker with low attack complexity and no user interaction can achieve confidentiality, integrity, and availability loss at the High level, with the Changed scope indicating the compromise can extend beyond the vulnerable component to the surrounding trusted environment. Affected systems are TOTOLINK A3002MU units running firmware 1.0.0-B20230403.1455. Blast radius includes the entire downstream network segment behind the device, since a compromised router permits interception, redirection, and man-in-the-middle of all routed traffic. Business impact for SMB or branch deployments includes network-wide loss of confidentiality, potential lateral movement into trusted internal hosts, and availability loss if the device is crashed or held. EPSS is not yet scored; CISA KEV status is NO, but public exploit disclosure raises real-world risk irrespective of KEV listing.

Detection Guidance

Sigma Rule

title: TOTOLINK A3002MU QoS Rule Handler Stack Buffer Overflow Attempt
id: 8e9c1a2b-3f4d-4a5e-9b6c-totolink105285
status: experimental
description: Detects HTTP requests to the TOTOLINK A3002MU QoS handler with abnormally long addQos/comment/entry_name parameters indicative of CVE-2026-105285 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105285
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: '/boafrm/formIpQoS'
  selection_params:
    cs-uri-query|contains:
      - 'addQos='
      - 'comment='
      - 'entry_name='
  selection_length:
    cs-uri-query|re: '.*(addQos|comment|entry_name)=[A-Za-z0-9%._-]{512,}.*'
  condition: selection_uri and selection_params and selection_length
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate QoS rule submissions with unusually long comment fields
level: high

YARA Rule

rule CVE_2026_105285_TOTOLINK_QoS_BOF
{
    meta:
        description = "Detects exploitation attempts against TOTOLINK A3002MU QoS Rule Handler (CVE-2026-105285)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105285"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $uri = "/boafrm/formIpQoS" ascii wide nocase
        $p1 = "addQos=" ascii
        $p2 = "comment=" ascii
        $p3 = "entry_name=" ascii

    condition:
        $uri and any of ($p*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105285 TOTOLINK A3002MU QoS Buffer Overflow Attempt"; flow:to_server,established; http.uri; content:"/boafrm/formIpQoS"; http.uri; content:"addQos"; nocase; pcre:"/(addQos|comment|entry_name)=[A-Za-z0-9%._-]{512,}/Ui"; classtype:attempted-admin; reference:cve,2026-105285; sid:2026105285; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where http.request.method == "POST" and url.path == "/boafrm/formIpQoS"]
  [network where http.request.method == "POST" and url.path == "/boafrm/formIpQoS" and
   url.query =~ ".*(addQos|comment|entry_name)=.{512,}.*"]

Splunk SPL Query

index=web OR index=network sourcetype=*access* OR sourcetype=suricata
| search uri_path="/boafrm/formIpQoS" OR url="/boafrm/formIpQoS"
| eval param_len=len(uri_query)
| where param_len > 500 AND match(uri_query,"(addQos|comment|entry_name)=")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_query
| sort - count

Wazuh OSSEC Rule

<group name="totolink,web,attack,">
  <rule id="105285" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/boafrm/formIpQoS</url>
    <regex type="pcre2">(addQos|comment|entry_name)=[A-Za-z0-9%._-]{512,}</regex>
    <description>CVE-2026-105285: Suspected TOTOLINK A3002MU QoS Rule Handler buffer overflow exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105285,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict management access to the device: disable WAN-side administration and block external reachability of /boafrm/ paths via firewall/ACL; only permit trusted administrative networks. Where the device cannot be segmented, place it behind a device that enforces addQos/comment/entry_name parameter length limits at the edge. Deploy the detection rules above to alert on oversized parameter submissions to /boafrm/formIpQoS. Because no official fix exists, treat the device as untrusted until remediated.
2. Patch / upgrade steps. No vendor patch is currently available from any tracked source (vendor fix N/A). Check the TOTOLINK support site for a firmware release newer than 1.0.0-B20230403.1455 and apply it promptly if one is published; verify firmware authenticity before flashing. If no fixed firmware is issued, plan hardware replacement with a supported, actively maintained device.
3. Long-term hardening. Segment IoT/SMB networking equipment from production segments; enforce network monitoring for anomalous parameter lengths on embedded web UIs; maintain an inventory of exposed firmware versions and subscribe to TOTOLINK advisories. Harden the management plane with least-privilege access and disable unused services (e.g., WAN admin, remote management) by default.

References

• NVD — CVE-2026-105285: https://nvd.nist.gov/vuln/detail/CVE-2026-105285
• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Vendor (TOTOLINK) support / firmware downloads: https://www.totolink.net/
• CISA KEV Catalog (status: not listed as of data capture): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No specific threat actor campaign or in-the-wild exploitation beyond the noted public disclosure is documented in the provided data. Exploit code was reported as publicly disclosed; no PoC, Nuclei template, or tracked exploit repository entry is included in the supplied intelligence.