PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-36837 TOTOLINK CVE debrief

A stack-based buffer overflow vulnerability was discovered in TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 via the hostname parameter in the formMapDelDevice function. This HIGH severity vulnerability has a CVSS score of 7.5. Defenders responsible for managing and securing TOTOLINK A3002RU V3 devices should assess exposure and prioritize patching or mitigation efforts. The vulnerability is classified as HIGH severity and has the potential for exploitation. Additional information on affected systems and exploitation attempts is limited.

Vendor
TOTOLINK
Product
A3002RU V3
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-29
Original CVE updated
2026-10-23
Advisory published
2026-04-29
Advisory updated
2026-10-23

Who should care

Defenders responsible for managing and securing TOTOLINK A3002RU V3 devices should assess exposure and prioritize patching or mitigation efforts.

Why it matters

Defenders should prioritize verification of affected systems and apply patches if available due to the HIGH severity of the vulnerability and potential for exploitation.

  • Verify patch availability and apply patches to vulnerable systems
  • Monitor network traffic for potential exploitation attempts
  • Implement compensating controls to limit access to vulnerable systems

Technical summary

The TOTOLINK A3002RU V3 device contains a stack-based buffer overflow vulnerability via the hostname parameter in the formMapDelDevice function. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. Defenders should prioritize verification of affected systems and apply patches if available. The vulnerability has the potential for exploitation, and defenders should monitor network traffic for potential exploitation attempts.

Defensive priority

Defenders should prioritize verification of affected systems and apply patches if available.

Recommended defensive actions

  • Verify if the system is affected by checking the version and applying patches if available
  • Monitor network traffic for potential exploitation attempts
  • Implement compensating controls to limit access to vulnerable systems

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or affected systems is limited. The TOTOLINK A3002RU V3 device is affected by this vulnerability. Defenders should verify patch availability and apply patches to vulnerable systems. The CVE record was published on 2026-04-29T15:16:05.530Z and has not been modified since then. The NVD entry provides a detailed assessment of the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-36837 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-36837

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-36837 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-36837

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.