Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-15271

A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:442a308daa7c54154e1b5480bd2561764960f6d742d5c8103fb93e53c0582fd4
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
3

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 7 assertions

{"cpes":["cpe:2.3:a:totolink:cp450:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"CP450","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/4

{"cpes":["cpe:2.3:a:totolink:ex200:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"EX200","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/6

{"cpes":["cpe:2.3:a:totolink:a3100r:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"A3100R","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/1

{"cpes":["cpe:2.3:a:totolink:a950rg:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"A950RG","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/2

{"cpes":["cpe:2.3:a:totolink:ac1200t10:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"AC1200T10","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/3

{"cpes":["cpe:2.3:a:totolink:a3000ru:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"A3000RU","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/0

{"cpes":["cpe:2.3:a:totolink:cs185r_t10:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"CS185R_T10","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/5
cvss · 4 assertions

{"metric":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/metrics/1/cvssV3_1

{"metric":{"baseScore":7.1,"vectorString":"AV:N/AC:H/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR","version":"2.0"},"metric_type":"cvssV2_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/metrics/3/cvssV2_0

{"metric":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R","version":"3.0"},"metric_type":"cvssV3_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/metrics/2/cvssV3_0

{"metric":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X","version":"4.0"},"metric_type":"cvssV4_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/metrics/0/cvssV4_0
cwe · 2 assertions

{"cweId":"CWE-272","description":"Least Privilege Violation","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-266","description":"Incorrect Privilege Assignment","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

7 source assertions
{"cpes":["cpe:2.3:a:totolink:cp450:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"CP450","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/4
{"cpes":["cpe:2.3:a:totolink:ex200:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"EX200","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/6
{"cpes":["cpe:2.3:a:totolink:a3100r:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"A3100R","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/1
{"cpes":["cpe:2.3:a:totolink:a950rg:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"A950RG","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/2
{"cpes":["cpe:2.3:a:totolink:ac1200t10:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"AC1200T10","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/3
{"cpes":["cpe:2.3:a:totolink:a3000ru:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"A3000RU","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/0
{"cpes":["cpe:2.3:a:totolink:cs185r_t10:*:*:*:*:*:*:*:*"],"modules":["Web Interface"],"product":"CS185R_T10","vendor":"TOTOLINK","versions":[{"status":"affected","version":"20260906"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/affected/5

Provider-owned CVSS observations

4 source assertions
{"metric":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/metrics/1/cvssV3_1
{"metric":{"baseScore":7.1,"vectorString":"AV:N/AC:H/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR","version":"2.0"},"metric_type":"cvssV2_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/metrics/3/cvssV2_0
{"metric":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R","version":"3.0"},"metric_type":"cvssV3_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/metrics/2/cvssV3_0
{"metric":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X","version":"4.0"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

2 source assertions
{"cweId":"CWE-272","description":"Least Privilege Violation","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/problemTypes/0/descriptions/0
{"cweId":"CWE-266","description":"Incorrect Privilege Assignment","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/problemTypes/1/descriptions/0

Source references

12 source assertions
{"tags":["related"],"url":"https://app.notion.com/p/A3000RU-V5-9c-5185-37a1f5ba989080d38bb6ca58b2a98c64?source=copy_link"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/10
{"name":"CVE-2026-15271 | CVE Analysis and Report","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-15271"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/2
{"name":"Submit #852316 | TOTOLink A3000RU A3000RU V5.9c.5185 Misconfiguration in A3000RU","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/852316"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/3
{"name":"Submit #852317 | TOTOLink A3100R A3100R V4.1.2cu.5050 Misconfiguration in A3100R (Duplicate)","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/852317"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/4
{"name":"Submit #852318 | TOTOLink AC1200T10 V2 AC1200T10 V2 V4.1.8cu.5207 Misconfiguration in AC1200T10 V2 (Duplicate)","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/852318"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/5
{"name":"Submit #852319 | TOTOLink CP450 CP450 V4.1.0cu.747 Misconfiguration in CP450 (Duplicate)","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/852319"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/6
{"name":"Submit #852320 | TOTOLink CS185R_T10 CS185R_T10 V5.9c.1485 Misconfiguration in CS185R_T10 (Duplicate)","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/852320"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/7
{"name":"Submit #852321 | TOTOLink EX200 EX200 V4.0.3c.7646 Misconfiguration in EX200 (Duplicate)","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/852321"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/8
{"name":"Submit #852323 | TOTOLink A950RG A950RG V5.9c.4592 Misconfiguration in A950RG (Duplicate)","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/852323"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/9
{"name":"VDB-377214 | TOTOLINK EX200 Web boa.conf least privilege violation","tags":["vdb-entry"],"url":"https://vuldb.com/vuln/377214"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/0
{"name":"VDB-377214 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/377214/cti"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/1
{"tags":["product"],"url":"https://www.totolink.net/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f689c2fb3be40364eff570b308909a031ded44e5a372ab60985a9fa3ff7a8a68 · sha256:2d9bd6800ba93d98… · /containers/cna/references/11

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer