CVE-2026-15271

TOTOLINK EX200 Web boa.conf least privilege violation

Published Jul 9, 2026 CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Totolink ac1200 T10
Vendors & Products Totolink ac1200 T10
Type Values Removed Values Added
Description A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult.
Title TOTOLINK EX200 Web boa.conf least privilege violation
First Time appeared Totolink
Totolink a3000ru
Totolink a3100r
Totolink a950rg
Totolink ac1200t10
Totolink cp450
Totolink cs185r T10
Totolink ex200
Weaknesses CWE-266
CWE-272
CPEs cpe:2.3:a:totolink:a3000ru:*:*:*:*:*:*:*:*
cpe:2.3:a:totolink:a3100r:*:*:*:*:*:*:*:*
cpe:2.3:a:totolink:a950rg:*:*:*:*:*:*:*:*
cpe:2.3:a:totolink:ac1200t10:*:*:*:*:*:*:*:*
cpe:2.3:a:totolink:cp450:*:*:*:*:*:*:*:*
cpe:2.3:a:totolink:cs185r_t10:*:*:*:*:*:*:*:*
cpe:2.3:a:totolink:ex200:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a3000ru
Totolink a3100r
Totolink a950rg
Totolink ac1200t10
Totolink cp450
Totolink cs185r T10
Totolink ex200
References
Metrics cvssV2_0

{'score': 7.1, 'vector': 'AV:N/AC:H/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 10, 2026, 1:37 PM
Reserved
Jul 9, 2026, 2:50 PM
Status
Deferred
Published
Jul 9, 2026, 10:17 PM
Modified
Sep 3, 2026, 4:15 AM