CVE-2026-90605: Totolink A3002MU Buffer Overflow Vulnerability

CVE-2026-90605 Overview

CVE-2026-90605 is a buffer overflow vulnerability in the Totolink A3002MU router running firmware version Hh-B20211125.1046. The flaw resides in the formFilter function of the /boafrm/formFilter endpoint served by the boa web server component. An attacker can trigger the overflow by manipulating the ip6addr argument sent to the vulnerable handler. The issue is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. Public exploit details are available, increasing the likelihood of opportunistic exploitation against exposed devices.

Critical Impact
Remote attackers with low privileges can corrupt memory on the router, potentially leading to arbitrary code execution and full device compromise.

Affected Products

Totolink A3002MU router
Firmware version Hh-B20211125.1046
boa web server component (/boafrm/formFilter handler)

Discovery Timeline

2026-09-14 - CVE-2026-90605 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90605

Vulnerability Analysis

The vulnerability lives in the formFilter function inside the boa HTTP daemon that powers the router's administrative interface. When the endpoint /boafrm/formFilter processes a request, it reads the ip6addr parameter from user input and copies it into a fixed-size stack buffer without validating the input length. Because the router firmware is compiled without modern memory protections common in embedded systems, overflowing this buffer overwrites adjacent stack data, including saved return addresses. The public proof of concept demonstrates that a network-reachable request is sufficient to trigger the overflow, and the GitHub buffer overflow report documents the request layout.

Root Cause

The root cause is missing bounds checking on the ip6addr parameter before it is copied into a stack-allocated buffer inside formFilter. The handler trusts client-supplied input length, a recurring pattern in older SOHO router firmware that lacks safe string APIs.

Attack Vector

Exploitation requires network access to the router's management interface and low-privileged authentication. An attacker submits a crafted HTTP POST request to /boafrm/formFilter with an oversized ip6addr value. Successful exploitation corrupts stack memory, enabling denial of service and, on unpatched embedded targets, arbitrary code execution in the context of the web daemon. Additional technical context is available in the VulDB CVE-2026-90605 entry.

No verified exploit code is reproduced here. See the GitHub buffer overflow report for the researcher's proof of concept.

Detection Methods for CVE-2026-90605

Indicators of Compromise

HTTP POST requests to /boafrm/formFilter containing abnormally long ip6addr parameter values.
Unexpected reboots or crashes of the boa process on affected Totolink A3002MU devices.
Configuration changes, new administrative sessions, or unfamiliar firewall rules appearing on the router.

Detection Strategies

Inspect web-facing router logs and upstream proxies for requests targeting /boafrm/formFilter with parameter lengths exceeding typical IPv6 address strings.
Deploy network intrusion detection signatures that flag oversized ip6addr values or non-ASCII binary payloads in formFilter requests.
Correlate router crash telemetry with inbound HTTP traffic patterns to identify probing or exploitation attempts.

Monitoring Recommendations

Forward router syslog and management-plane traffic into a centralized SIEM for correlation with network telemetry.
Monitor for outbound connections from the router to unexpected destinations, which may indicate post-exploitation activity.
Alert on any exposure of the router's administrative interface to the public internet.

How to Mitigate CVE-2026-90605

Immediate Actions Required

Restrict access to the router's web management interface to trusted internal management VLANs only.
Disable remote WAN-side administration if enabled on the Totolink A3002MU.
Rotate administrative credentials and enforce strong, unique passwords to raise the bar for the low-privilege prerequisite.
Inventory environments for Totolink A3002MU devices running firmware Hh-B20211125.1046 and prioritize their remediation.

Patch Information

At the time of publication, no vendor patch is referenced in the advisory data. Monitor the Totolink official website for updated firmware addressing the formFilter buffer overflow, and apply it as soon as it becomes available.

Workarounds

Place vulnerable routers behind an upstream firewall that blocks unauthenticated access to /boafrm/formFilter.
Use a reverse proxy or WAF rule to drop requests where the ip6addr parameter exceeds the maximum valid IPv6 textual length of 45 characters.
Consider replacing end-of-life or unsupported Totolink A3002MU units with actively maintained hardware where feasible.

bash

# Example iptables rule limiting management-plane access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP