CVE-2026-15271TOTOLINK EX200 Web boa.conf least privilege violation

A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult.

7.7 HIGHEPSS 0.70%Not in KEVNVD: Deferred

Last updated: 2026-09-03 04:15 UTC

OverviewCVSS details

7.7HIGHCVSS 4.0

Score source: VulDB (CNA)
NVD status: Deferred
Published: Jul 9, 2026
Assigner: VulDB

Affected

A3000RU (TOTOLINK)

Versions: 20260906

+6 more products →

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation none · Automatable no · Impact total

EPSS · FIRST, scored Nov 8

0.70%chance of exploitation in 30 days

Higher than 53.62% of CVEs

CVSS 4.0 · VulDB (CNA)

7.7High

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · VulDB (CNA)

7.5High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 3.1 · VulDB (CNA)

7.5High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/RC:R

Attack vector: Network
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 3.0 · VulDB (CNA)

7.5High

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/RC:R

Attack vector: Network
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 2.0 · VulDB (CNA)

7.1High

AV:N/AC:H/Au:S/C:C/I:C/A:C

Attack vector: Network
Attack complexity: High
Authentication: Single
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

CVSS 2.0 · VulDB (CNA)

7.1High

AV:N/AC:H/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR

Attack vector: Network
Attack complexity: High
Authentication: Single
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

NVD status: Deferred

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
7.7	HIGH	4.0VulDB (CNA)	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.5	HIGH	3.1VulDB (CNA)	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.5	HIGH	3.1VulDB (CNA)	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/RC:R
7.5	HIGH	3.0VulDB (CNA)	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/RC:R
7.1	HIGH	2.0VulDB (CNA)	AV:N/AC:H/Au:S/C:C/I:C/A:C
7.1	HIGH	2.0VulDB (CNA)	AV:N/AC:H/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR

Details

CVE ID: CVE-2026-15271
Status: Deferred
Assigner (CNA): VulDB
Published: Jul 9, 2026
Last modified: 2026-09-03 04:15 UTC
Weaknesses: CWE-272 · Least Privilege Violation
CWE-266 · Incorrect Privilege Assignment

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 09:18 UTC.