CVE-2026-90608: Totolink A3002MU Router RCE Vulnerability

CVE-2026-90608 Overview

CVE-2026-90608 is a buffer overflow vulnerability in the Totolink A3002MU router running firmware version Hh-B20211125.1046. The flaw resides in the formPortFw function within /boafrm/formPortFw, part of the boa web server component. Attackers can trigger the overflow by manipulating the service_type parameter over the network. A public exploit exists, increasing the likelihood of opportunistic attacks against exposed devices. The vulnerability is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
Remote attackers with low privileges can corrupt memory in the router's web server, potentially leading to arbitrary code execution, device compromise, or denial of service on affected Totolink A3002MU devices.

Affected Products

Totolink A3002MU router
Firmware version Hh-B20211125.1046
boa web server component (/boafrm/formPortFw)

Discovery Timeline

2026-09-14 - CVE-2026-90608 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90608

Vulnerability Analysis

The vulnerability exists in the formPortFw handler exposed by the boa HTTP server on the Totolink A3002MU. When processing port forwarding requests, the handler reads the service_type argument from the incoming HTTP request without validating its length before copying it into a fixed-size stack buffer. This unchecked copy leads to a classic stack-based buffer overflow, as documented in the public technical writeup.

Because boa runs with elevated privileges on embedded routers and typically lacks modern exploit mitigations such as stack canaries and ASLR, memory corruption in this path can escalate to arbitrary code execution on the device.

Root Cause

The root cause is missing input length validation on the service_type parameter inside formPortFw. The function trusts client-supplied data and performs a bounded-copy operation with insufficient checks, allowing a longer-than-expected value to overwrite adjacent stack memory, including the saved return address.

Attack Vector

Exploitation occurs over the network against the router's web management interface. An authenticated attacker with low privileges sends a crafted HTTP POST request to /boafrm/formPortFw containing an oversized service_type value. Devices with the management interface exposed to untrusted networks face the highest risk. A proof-of-concept has been published, and additional details are catalogued in the VulDB entry for CVE-2026-90608.

Detection Methods for CVE-2026-90608

Indicators of Compromise

HTTP POST requests to /boafrm/formPortFw containing abnormally long service_type parameter values
Unexpected restarts or crashes of the boa web server process on the router
New or modified port forwarding rules that were not created by administrators
Outbound connections from the router to unknown hosts, indicating possible post-exploitation activity

Detection Strategies

Inspect web server and router logs for repeated or malformed requests targeting the formPortFw endpoint
Deploy network intrusion detection signatures that flag HTTP requests to /boafrm/formPortFw exceeding expected parameter sizes
Baseline normal management traffic to the router and alert on deviations in request volume or content length

Monitoring Recommendations

Forward router syslog and web access logs to a centralized log platform for retention and correlation
Monitor for unauthorized configuration changes, especially additions to port forwarding tables
Track authentication events on the router's web interface to identify credential abuse preceding exploitation attempts

How to Mitigate CVE-2026-90608

Immediate Actions Required

Restrict access to the router's web management interface to trusted internal networks only and disable remote WAN administration
Change default and weak administrative credentials to reduce the risk of low-privileged attackers reaching the vulnerable endpoint
Audit existing port forwarding rules and remove any that are unrecognized or unnecessary
Isolate the affected Totolink A3002MU devices behind a network segment with strict egress filtering until remediation is available

Patch Information

At the time of publication, no vendor-supplied patch has been referenced in the CVE data. Administrators should monitor the Totolink official website for firmware updates addressing the formPortFw buffer overflow. If the device is end-of-life or updates are not forthcoming, consider replacing it with a supported model.

Workarounds

Disable remote web administration and block inbound HTTP/HTTPS access to the router from the internet at the perimeter firewall
Place the router's management VLAN behind an access control list that only permits trusted management workstations
Where feasible, disable the port forwarding feature to reduce exposure of the vulnerable handler
Replace unsupported Totolink A3002MU devices with actively maintained hardware if no firmware fix is released

bash

# Example: block inbound access to the router web interface at an upstream firewall
# Replace ROUTER_IP with the router's WAN address and MGMT_NET with your admin subnet
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 80 -s MGMT_NET -j ACCEPT
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 80 -j DROP
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 443 -s MGMT_NET -j ACCEPT
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 443 -j DROP