CVE-2026-90606
Received Received - Intake

Buffer Overflow in Totolink A3002MU Router Firmware

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static_ipv6 leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90606
EUVD
EUVD-2026-77141

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
totolink a3002mu h-h-b20211125.1046

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90606 is a buffer overflow vulnerability in the TOTOlink A3002MU router affecting the formIpv6Setup function in the /bin/boa web server. The static_ipv6 parameter is copied into a fixed-size buffer without proper length checks. A remote attacker can exploit this by sending a crafted HTTP POST request with an excessively long static_ipv6 value, causing memory corruption and crashing the Boa web server process.

Detection Guidance

To detect this vulnerability, monitor network traffic for HTTP POST requests to the /boafrm/formIpv6Setup endpoint with unusually long static_ipv6 parameters. Check if the Boa web server process crashes or becomes unresponsive after such requests.

Impact Analysis

This vulnerability can lead to a denial-of-service condition where the router's management interface becomes unresponsive. An attacker could exploit it remotely to crash the device, disrupting network services and preventing legitimate access to the router's configuration.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling remote denial-of-service attacks on network infrastructure. Buffer overflows may lead to unauthorized access or disruption of critical services, which could violate data protection requirements under GDPR (e.g., integrity of personal data) and HIPAA (e.g., availability of healthcare systems).

Mitigation Strategies

Immediately update the router's firmware to a patched version if available. If no patch exists, restrict access to the router's management interface by blocking external connections to the /boafrm/formIpv6Setup endpoint via firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90606. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart