CVE-2026-90606

The TOTOLINK A3002MU router, firmware version Hh-B20211125.1046, contains a buffer overflow (CWE-119/120) in the formIpv6Setup function of the embedded boa web server, reachable via the /boafrm/formIpv6Setup endpoint. A remote attacker triggers the flaw by sending an excessively long value in the static_ipv6 parameter of an IPv6 configuration request; the CVSS vector indicates low privileges are required, so the attacker likely needs to be authenticated to the router's admin interface. Successful exploitation can crash or fully compromise the device, with high impact to confidentiality, integrity, and availability of both the router and subsequent systems that depend on it. Anyone running this specific A3002MU firmware version — typically home or small-office users with the management interface reachable — is affected. The entry notes the exploit has been disclosed publicly (CVSS E:P), but no active exploitation in the wild is known and the flaw is not on the CISA KEV list.

What to do: Check TOTOLINK's support site for a firmware update for the A3002MU and apply it if one exists; if no patch is available, disable WAN-side/remote administration so the boa interface is reachable only from the LAN, change default admin credentials (since exploitation appears to require authentication), and consider retiring the device. Monitor device logs or upstream firewalls for requests to /boafrm/formIpv6Setup containing abnormally long static_ipv6 values.