Critical severity · published Sep 13, 2026
CVE-2026-90605
Totolink A3002MU boa formFilter buffer overflow
9.9
CVSS
0.9%
EPSS
No
On KEV
Description
A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A3
A3002MU · Totolink
Hh-B20211125.1046 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90605
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90605
github.com
https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formFilter.md
vuldb.com
https://vuldb.com/cve/CVE-2026-90605
vuldb.com
https://vuldb.com/submit/914009
vuldb.com
https://vuldb.com/vuln/403187
vuldb.com
https://vuldb.com/vuln/403187/cti
www.totolink.net
https://www.totolink.net/
More from A3002MU
10.0
CVE-2026-105285
Totolink A3002MU QoS Rule formIpQoS stack-based overflow
10.0
CVE-2026-105284
Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization
10.0
CVE-2026-93741
Totolink A3002MU formWlWds buffer overflow
10.0
CVE-2026-93740
Totolink A3002MU formWlEncrypt buffer overflow
9.9
CVE-2026-93742
Totolink A3002MU formWsc command injection