CVE-2026-15271: TOTOLINK EX200 Web boa.conf least privilege violation
Vulnerability summary
CVE-2026-15271 is a high (CVSS 7.7) Incorrect Privilege Assignment vulnerability in totolink a3000ru_firmware. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.8% of scored vulnerabilities.
Timeline
- 09-07-2026PublishedVulnerability first disclosed.
- 10-07-2026Last modifiedVulnerability information updated.
Description
A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST7.7HighCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.1HighAV:N/AC:H/Au:S/C:C/I:C/A:C
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.71% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- CWE-272Least Privilege ViolationThe elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
Affected systems
Totolink7 products
- a3000ru_firmware20260906
- a3100r_firmware20260906
- a950rg20260906
- ac1200t1020260906
- cp450_firmware20260906
1 vendor · 7 products
References
12 links- vuldb.com/vuln/377214VDB Entry
- vuldb.com/cve/CVE-2026-15271Third Party Advisory
- vuldb.com/submit/852316Third Party Advisory
- vuldb.com/submit/852317Third Party Advisory
- vuldb.com/submit/852318Third Party Advisory
- vuldb.com/submit/852319Third Party Advisory
- vuldb.com/submit/852320Third Party Advisory
- vuldb.com/submit/852321Third Party Advisory
- vuldb.com/submit/852323Third Party Advisory
Show all 12 references
- www.totolink.netProduct