High 7.5Published Jul 9, 2026

CVE-2026-15271TOTOLINK EX200 Web boa.conf least privilege violation

Updated under an hour ago (Oct 27, 2026, 6:50 PM ET)

Does this affect you?

It affects TOTOLINK A3000RU and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for TOTOLINK A3000RU

Exploited in the last 30 days

A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R
Weakness (CWE): CWE-272, CWE-266
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Jul 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

TOTOLINK A3000RU totolink:a3000ru	20260906	CNA record
TOTOLINK A3100R totolink:a3100r	20260906	CNA record
TOTOLINK A950RG totolink:a950rg	20260906	CNA record
TOTOLINK AC1200T10 totolink:ac1200t10	20260906	CNA record
TOTOLINK CP450 totolink:cp450	20260906	CNA record
TOTOLINK CS185R_T10 totolink:cs185r_t10	20260906	CNA record
TOTOLINK EX200 totolink:ex200	20260906	CNA record

References

References

https://vuldb.com/vuln/377214	vdb-entry
https://vuldb.com/vuln/377214/cti	signature, permissions-required
https://vuldb.com/cve/CVE-2026-15271	third-party-advisory
https://vuldb.com/submit/852316	third-party-advisory
https://vuldb.com/submit/852317	third-party-advisory
https://vuldb.com/submit/852318	third-party-advisory
https://vuldb.com/submit/852319	third-party-advisory
https://vuldb.com/submit/852320	third-party-advisory
https://vuldb.com/submit/852321	third-party-advisory
https://vuldb.com/submit/852323	third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.