CVE-2026-15271highCWE-266CWE-272

CVE-2026-15271: fallo de gravedad alta en TOTOLINK EX200

TOTOLINK EX200 Web boa.conf least privilege violation

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear A950RG+ Monitorear EX200

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.7epss 0.7%
A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X
Productos afectados
TOTOLINK · A3000RUTOTOLINK · A3100RTOTOLINK · A950RGTOTOLINK · AC1200T10TOTOLINK · CP450TOTOLINK · CS185R_T10TOTOLINK · EX200
CVEs relacionadas — TOTOLINK EX200

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-7157HIGHTOTOLINK A3100R getSaveConfig buffer overflowEPSS 7.4%CVE-2024-7158MEDIUMTOTOLINK A3100R HTTP POST Request cstecgi.cgi setTelnetCfg command injectionEPSS 3.1%CVE-2026-116505CRITICALTOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injectionEPSS 2.7%CVE-2026-114575CRITICALTOTOLINK A950RG product.so UploadCustomModule command injectionEPSS 2.2%CVE-2026-116506CRITICALTOTOLINK A950RG firewall.so apmib_set command injectionEPSS 1.9%CVE-2026-116504CRITICALTOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injectionEPSS 1.5%