CVE-2026-90606: Totolink A3002MU Buffer Overflow Vulnerability

CVE-2026-90606 Overview

CVE-2026-90606 is a stack-based buffer overflow in the TOTOLINK A3002MU router firmware version Hh-B20211125.1046. The flaw resides in the formIpv6Setup function of /boafrm/formIpv6Setup, part of the embedded boa web server. An attacker can manipulate the static_ipv6 argument to overflow a fixed-size buffer. The exploit has been publicly disclosed and can be triggered remotely over the network. This class of memory corruption is tracked under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
Remote attackers with low-privilege authentication can corrupt router memory, potentially achieving arbitrary code execution on the device and pivoting into the internal network.

Affected Products

TOTOLINK A3002MU router
Firmware version Hh-B20211125.1046
The boa HTTP server component handling /boafrm/formIpv6Setup

Discovery Timeline

2026-09-14 - CVE-2026-90606 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90606

Vulnerability Analysis

The vulnerability affects the IPv6 configuration handler exposed through the boa web server on the TOTOLINK A3002MU. When a user submits IPv6 settings, the formIpv6Setup function processes the static_ipv6 HTTP parameter without enforcing a maximum length check before copying it into a fixed-size stack buffer. Supplying an oversized value overwrites adjacent stack memory, including saved return addresses. Exploitation requires network reachability to the router's management interface and low-privilege authentication. Successful exploitation compromises confidentiality, integrity, and availability of the device, and the impact extends into connected downstream systems.

Root Cause

The root cause is missing bounds validation in the request handler. The formIpv6Setup routine copies the attacker-controlled static_ipv6 field into a stack buffer using an unbounded string operation. Embedded HTTP daemons on consumer routers frequently rely on strcpy or sprintf variants that do not enforce destination limits, which produces the classic stack overflow condition described by CWE-119.

Attack Vector

The attack is delivered as an HTTP POST request to /boafrm/formIpv6Setup on the router's web management interface. An authenticated attacker on the LAN, or a remote attacker if the management interface is exposed to the WAN, submits a crafted static_ipv6 value large enough to overwrite the return address on the stack. Because MIPS-based TOTOLINK firmware typically ships without modern exploit mitigations such as ASLR or stack canaries, the overflow is a viable path to arbitrary code execution. Public exploitation notes are available in the GitHub BoF Exploit Documentation and the VulDB CVE-2026-90606 Details advisory.

No verified proof-of-concept code is reproduced here. See the referenced advisories for the technical walkthrough.

Detection Methods for CVE-2026-90606

Indicators of Compromise

HTTP POST requests to /boafrm/formIpv6Setup containing unusually long static_ipv6 parameter values.
Unexpected reboots, watchdog resets, or crash logs from the boa process on affected TOTOLINK A3002MU units.
New or unexplained administrative sessions on the router preceded by malformed IPv6 configuration submissions.
Outbound traffic from the router itself to unfamiliar hosts, indicating potential post-exploitation implants.

Detection Strategies

Inspect web-application firewall or network intrusion detection logs for POST bodies to formIpv6Setup with static_ipv6 values exceeding typical IPv6 address length (39 characters).
Correlate router availability metrics with configuration-change events to spot crash-restart cycles caused by exploitation attempts.
Baseline expected management traffic and alert on external sources touching the router administrative interface.

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized log platform for retention and pattern analysis.
Monitor for repeated 5xx responses from /boafrm/* endpoints, which can indicate fuzzing or overflow attempts.
Track firmware version inventory across deployed TOTOLINK devices to identify vulnerable units.

How to Mitigate CVE-2026-90606

Immediate Actions Required

Restrict router administrative access to trusted management VLANs and disable WAN-side management on the TOTOLINK A3002MU.
Rotate administrator credentials and enforce strong, unique passwords to raise the bar for the authenticated attack requirement.
Segment the router from sensitive internal assets so a compromised device cannot pivot laterally.
Audit deployed firmware against the vulnerable Hh-B20211125.1046 build and prioritize replacement or upgrade.

Patch Information

As of the NVD publication date, no vendor patch has been referenced for CVE-2026-90606. Check the TOTOLINK Official Website for firmware updates that address the formIpv6Setup handler. Consider replacing the device if the vendor does not release a fix within an acceptable window, particularly for A3002MU units that have reached end-of-support.

Workarounds

Disable the IPv6 configuration page in the web interface if it is not required in the deployment.
Place the router behind an upstream firewall that filters unsolicited requests to /boafrm/formIpv6Setup.
Deploy an intrusion prevention rule that drops HTTP requests whose static_ipv6 parameter exceeds a strict length threshold.
Where feasible, migrate to a supported router platform that receives active security maintenance.

bash

# Example upstream firewall rule concept (iptables) to block oversized POSTs
# to the vulnerable endpoint on the router management IP 192.0.2.1
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 \
  -m string --algo bm --string "/boafrm/formIpv6Setup" \
  -m length --length 1000:65535 -j DROP