CVE-2026-90605

A remote buffer overflow (CWE-119/CWE-120) exists in the boa web server component of the Totolink A3002MU router, specifically in the formFilter function reachable via the /boafrm/formFilter endpoint. An attacker triggers the flaw by sending an overly long or malformed value in the ip6addr argument, which is not properly length-checked before being copied into a fixed-size buffer. Successful exploitation occurs over the network with low privileges required (per the CVSS 4.0 vector, PR:L) and can crash the device or potentially achieve code execution, compromising the router's confidentiality, integrity, and availability. Only firmware version Hh-B20211125.1046 is listed as affected. The vulnerability record states an exploit has been made available publicly, though no separate proof-of-concept is currently tracked, and there is no evidence of active exploitation (not in CISA KEV).

What to do: Check for and apply the latest Totolink firmware for the A3002MU, as only Hh-B20211125.1046 is confirmed affected and no fixed version is documented yet. Immediately disable remote/WAN-side administration of the router's web interface so the /boafrm/formFilter endpoint is not reachable from the internet, and restrict management access to the LAN. Monitor device logs and uptime for unexpected reboots or crashes, which could indicate exploitation attempts.