CVE-2026-90604: Totolink A3002MU XSS Vulnerability

CVE-2026-90604 is a cross site scripting vulnerability in Totolink A3002MU router affecting the Anchor Tag Handler component. Attackers can exploit this remotely to inject malicious scripts. This article covers technical details, affected firmware versions, security impact, and mitigation strategies.

CVE-2026-90604 Overview

CVE-2026-90604 is a cross-site scripting (XSS) vulnerability [CWE-79] affecting the TOTOLINK A3002MU router running firmware version Hh-B20211125.1046. The flaw resides in the device's Anchor Tag Handler component, where user-controlled input is rendered without proper output encoding. An authenticated remote attacker can inject script content that executes in the browser context of a victim interacting with the router's web interface. A public proof-of-concept exists, published on GitHub, increasing the likelihood of opportunistic exploitation against exposed devices.

Critical Impact
Successful exploitation allows script execution within an administrator's browser session, enabling theft of session data, unauthorized configuration changes, or pivoting into the internal network via the router's management interface.

Affected Products

TOTOLINK A3002MU router
Firmware version Hh-B20211125.1046
Anchor Tag Handler web component

Discovery Timeline

2026-09-14 - CVE-2026-90604 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90604

Vulnerability Analysis

The vulnerability affects the Anchor Tag Handler component within the A3002MU web management interface. The handler processes attacker-controlled parameters and reflects them into HTML anchor elements without sufficient sanitization or contextual encoding. This allows script payloads to break out of the intended attribute context and execute in the victim's browser.

Exploitation requires low-level privileges to reach the vulnerable endpoint and requires user interaction, such as clicking a crafted link or visiting a page rendered by the router. The attack is network-reachable, which makes it viable against any A3002MU device exposing its management interface to accessible networks.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Anchor Tag Handler concatenates user-supplied data into HTML output without applying output encoding appropriate to the anchor element context. As a result, characters such as quotes and angle brackets retain their HTML-active meaning when rendered.

Attack Vector

An attacker with authenticated access to the router crafts a URL containing malicious script content targeting the vulnerable handler. When another authenticated user, typically an administrator, follows the link or loads the affected page, the injected payload runs in their session context. The attacker can then read session tokens, submit configuration changes on the victim's behalf, or stage further attacks against clients on the local network.

For payload structure and reproduction steps, see the GitHub XSS Proof of Concept and the VulDB CVE-2026-90604 entry.

Detection Methods for CVE-2026-90604

Indicators of Compromise

HTTP requests to the A3002MU management interface containing <script>, onerror=, javascript:, or encoded variants in query or form parameters.
Unexpected outbound requests originating from an administrator's browser immediately after accessing the router UI.
Router configuration changes that do not correlate with legitimate administrative activity.

Detection Strategies

Inspect web server and proxy logs for requests to the router management interface containing HTML or JavaScript metacharacters in parameters handled by anchor-related endpoints.
Correlate administrator login sessions with anomalous configuration change events on the device.
Deploy network intrusion detection signatures matching reflected XSS payload patterns targeting TOTOLINK web interfaces.

Monitoring Recommendations

Monitor access to the A3002MU web administration interface and alert on connections from unexpected source addresses.
Track browser telemetry from administrator workstations for script execution originating from router IP addresses.
Review the VulDB CTI feed for vulnerability #403186 for updated exploitation intelligence.

How to Mitigate CVE-2026-90604

Immediate Actions Required

Restrict access to the A3002MU management interface to trusted management VLANs and specific administrator hosts.
Disable remote WAN-side administration if enabled on affected devices.
Instruct administrators to log out of the router UI after each session and avoid clicking untrusted links while authenticated.

Patch Information

No vendor-supplied patch has been referenced in the advisory at the time of publication. Consult the TOTOLINK Official Website and the VulDB Vulnerability #403186 record for firmware update availability.

Workarounds

Segment TOTOLINK A3002MU devices onto a dedicated management network isolated from user traffic.
Use a hardened, dedicated browser profile for router administration to limit the impact of script execution.
Enforce short session timeouts on the router web interface to reduce the window for exploitation.
Consider replacing end-of-support consumer routers with actively maintained hardware when no vendor patch is available.

bash

# Example: restrict management interface access at an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP