CVE-2026-105286

Executive Summary

CVE-2026-105286 is a path traversal vulnerability affecting Totolink A3002MU routers running firmware version 1.0.0-B20230403.1455. The flaw resides in the File Upload Handler component, specifically within the function sub_44B250 located in /boafrm/formUploadFile, where manipulation of the filename argument allows an attacker to write files outside the intended directory. The exploit is publicly available and remotely exploitable, though user interaction is required per the CVSS vector (UI:R), resulting in a CVSS score of 6.3 (Medium). Organizations using this specific Totolink router model are at risk of unauthorized file writes, which can lead to configuration manipulation, persistence, or denial of service.

Technical Analysis

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal). The affected component is the File Upload Handler accessible via the endpoint /boafrm/formUploadFile. The NVD description identifies the specific vulnerable function as sub_44B250, which processes the filename argument during file upload operations. By supplying a crafted filename value containing directory traversal sequences (e.g., ../), an attacker can manipulate the target path where the uploaded file is stored. This bypasses the intended upload directory restrictions, enabling arbitrary file writes within the router's filesystem, subject to the privileges of the web service.

The attack surface is the router's web-based management interface, which is typically exposed on the LAN or, in misconfigured deployments, the WAN. The vulnerability is remotely executable (AV:N), requires no authentication (PR:N), but does require user interaction (UI:R) — likely because the upload functionality may be triggered via a crafted request that a user must initiate, or because the exploit leverages a CSRF-like vector where the victim must visit a malicious page while authenticated. The manipulation of the filename argument directly influences file system operations without proper sanitization, leading to path traversal. The CVSS vector indicates low impact across confidentiality, integrity, and availability (C:L/I:L/A:L), suggesting limited but non-trivial consequences, such as reading or overwriting limited files or causing partial service disruption.

No public proof-of-concept code or Nuclei template is available, but the NVD description confirms the exploit is public. The lack of a CVE title and sparse description limits deeper code-level analysis; however, the vulnerability class and attack mechanism are clear: unsanitized user input in a file upload handler enables path traversal.

Exploitation Scenarios

The attack chain for CVE-2026-105286 can be described at the vulnerability-class level, as no specific code patterns or additional technical details are provided.

1. Reconnaissance/Target Identification: An attacker scans for Totolink A3002MU routers with firmware version 1.0.0-B20230403.1455. This can be done via Shodan using dorks such as product:"Totolink" or http.html:"boafrm". The attacker identifies the web management interface, typically on port 80 or 443.

2. Triggering the Flaw: The attacker crafts a malicious HTTP request to the /boafrm/formUploadFile endpoint. The request includes a file upload with a manipulated filename parameter containing path traversal sequences. Because the function sub_44B250 fails to properly sanitize the filename argument, the server writes the uploaded file to a path outside the intended upload directory. User interaction (UI:R) suggests the attacker may need to entice a logged-in user to submit the request, or the upload endpoint may require a session token that the attacker obtains through social engineering.

3. Payload/Execution: The uploaded file could be a configuration file, a script, or a binary. Depending on the exact path traversal destination and file type, the attacker might overwrite existing system files, inject malicious content into web directories, or plant a backdoor. The low integrity impact (I:L) indicates limited write capabilities, but even a single overwritten file can disrupt operations or enable further attacks.

4. Post-Exploitation Impact: Successful exploitation could lead to unauthorized configuration changes, persistent access via a web shell (if the upload directory is web-accessible), or denial of service by corrupting critical files. The low availability impact (A:L) suggests the attacker cannot fully disable the device but can cause partial outages. The low confidentiality impact (C:L) implies limited ability to read sensitive files, possibly through path traversal read operations if the upload handler also allows file retrieval.

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

Impact Assessment

The business impact of CVE-2026-105286 is moderate. Affected systems are Totolink A3002MU routers running firmware 1.0.0-B20230403.1455, commonly deployed in small office/home office (SOHO) environments, retail, and branch locations. The blast radius includes any network segment where these routers operate. Successful exploitation could allow an attacker to write arbitrary files, potentially leading to configuration tampering, insertion of malicious scripts, or disruption of network services. The CVSS score of 6.3 reflects a medium severity: remote exploitation, no authentication, but requiring user interaction. The confidentiality, integrity, and availability impacts are all low, meaning the attacker does not gain full control but can cause limited damage. However, in a network device, even limited file writes can be leveraged for persistence or lateral movement if the router is used as a gateway.

Detection Guidance

Sigma Rule

title: Totolink A3002MU Path Traversal File Upload Attempt
id: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2026-105286 via path traversal in filename parameter
author: Threat Intelligence
date: 2026-05-12
logsource:
  category: webserver
  product: totolink
detection:
  selection:
    http.url|contains: '/boafrm/formUploadFile'
    http.method: 'POST'
    http.request.body|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e/'
  condition: selection
falsepositives:
  - Legitimate file uploads with filenames containing dots
level: high
tags:
  - attack.t1190
  - cve.2026.105286

YARA Rule

rule CVE_2026_105286_Totolink_PathTraversal
{
    meta:
        description = "Detects path traversal attempts targeting Totolink A3002MU file upload"
        author = "Threat Intelligence"
        date = "2026-05-12"
        reference = "CVE-2026-105286"
        severity = "high"
    strings:
        $endpoint = "/boafrm/formUploadFile"
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $filename = "filename="
    condition:
        $endpoint and $filename and any of ($traversal*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105286 Totolink A3002MU Path Traversal File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/boafrm/formUploadFile"; http_uri; content:"filename="; http_client_body; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\/)/i"; reference:cve,2026-105286; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "POST" and url.path == "/boafrm/formUploadFile"]
  [network where http.request.body contains "../" or http.request.body contains "..\\" or http.request.body contains "%2e%2e%2f"]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri="/boafrm/formUploadFile" method=POST
| rex field=form_data "filename=(?<filename>[^&]+)"
| where match(filename, "\.\./|\.\.\\|%2e%2e%2f|%2e%2e/")
| stats count by src_ip, uri, filename, status
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100001" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>/boafrm/formUploadFile</match>
    <regex>filename=.*(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)</regex>
    <description>CVE-2026-105286: Totolink A3002MU path traversal file upload attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable the web management interface from WAN access; restrict administrative access to trusted LAN segments only.
   • Implement network segmentation to isolate IoT and router devices from critical assets.
   • Use a web application firewall (WAF) with rules to block path traversal sequences in upload requests to /boafrm/formUploadFile.
   • Monitor for unusual file upload activity or unexpected file writes in router logs.

2. Patch/Upgrade Steps:

   • There is no official patch available for firmware version 1.0.0-B20230403.1455. Contact Totolink support for a firmware update or replacement guidance.
   • If a patched firmware is released, prioritize upgrading immediately. Until then, consider replacing affected devices with models that have active security support.

3. Long-term Hardening:

   • Enforce the principle of least privilege for all web-accessible services.
   • Regularly audit firmware versions and apply updates promptly.
   • Implement egress filtering to prevent unauthorized outbound connections from compromised devices.
   • Conduct periodic vulnerability scans and penetration tests on network infrastructure.

References

1. NVD – CVE-2026-105286: https://nvd.nist.gov/vuln/detail/CVE-2026-105286
2. MITRE ATT&CK T1190 – Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
3. CWE-22 – Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
4. Totolink Official Website (for firmware updates): https://www.totolink.net/
5. CISA KEV Catalog (not applicable as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog