CVE-2026-90607

CVE-2026-90607 is a buffer overflow (CWE-119/120) in the boa web server component of the TOTOLINK A3002MU router, specifically in the formNewSchedule function handling requests to /boafrm/formNewSchedule. A remote attacker triggers the flaw by sending an oversized or manipulated submit-url argument to that endpoint, overwriting memory in the boa process. The CVSS 4.0 vector (8.6, AV:N/PR:L) indicates exploitation requires low privileges — typically a valid login to the router's web management interface — but yields high impacts on confidentiality, integrity, and availability, up to arbitrary code execution or a crash on the device. Only firmware version Hh-B20211125.1046 is confirmed affected; the advisory text states exploit details are public, though the vulnerability is not on the CISA KEV list and no in-the-wild campaigns are confirmed. Defenders should treat any internet-exposed TOTOLINK management interface running this firmware as at risk.

What to do: Check TOTOLINK's official support site for a firmware update for the A3002MU and apply it if one is available, since the advisory text indicates exploit details are public. Immediately disable remote/WAN access to the router's web management interface so it is reachable only from the LAN, and change any default or weak admin credentials since exploitation requires a valid low-privilege login. Inventory and isolate other TOTOLINK boa-based routers on your network, and monitor device logs for unexpected reboots or crashes of the management service.