A remote buffer overflow in the Totolink A3002MU router's boa web server carries a CVSS 3.1 score of 9.9 and already has publicly available exploit code.
What Is It
CVE-2026-90607 is a buffer overflow in the formNewSchedule function of the file /boafrm/formNewSchedule, part of the boa component on the Totolink A3002MU router. Manipulation of the submit-url argument triggers the overflow. The attack can be performed remotely, and the exploit is now public and may be used.
The vulnerability is classified under CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (classic buffer overflow). It was assigned by the VulDB CNA and currently carries a vulnerability status of "Received," meaning the record has not yet been analyzed or enriched.
Why It Matters
The CVSS 3.1 base score is 9.9 (CRITICAL), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That combination is the dangerous one: network reachable, low attack complexity, no user interaction, and only low privileges required. The scope is marked Changed, and confidentiality, integrity, and availability impacts are all High.
A CVSS 4.0 assessment from the same source scores it 8.6 (HIGH), with exploit maturity rated Proof-of-Concept. The legacy CVSS 2.0 score is 9.0. Public proof-of-concept code lowers the bar for opportunistic attacks against exposed devices.
What's Vulnerable
- Vendor: Totolink
- Product: A3002MU
- Affected version: Hh-B20211125.1046
- Affected component/module:
boa - CPE:
cpe:2.3:a:totolink:a3002mu:*:*:*:*:*:*:*:*
No other products or firmware versions are currently listed as affected.
Patch Status
CVE-2026-90607 does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmation of exploitation in the wild and no KEV-mandated remediation deadline for federal agencies. No patch, fixed version, vendor advisory, or recommended mitigation has been published. The only vendor-related reference available is the Totolink homepage.
Operators running the A3002MU should treat the device's web interface as untrusted: restrict management access to trusted local networks, ensure the router's administrative interface is not reachable from the internet, and monitor for a vendor firmware release.
Sources
- VulDB, CVE-2026-90607: https://vuldb.com/cve/CVE-2026-90607
- VulDB, Vulnerability 403189: https://vuldb.com/vuln/403189
- VulDB, CTI details: https://vuldb.com/vuln/403189/cti
- VulDB, Submission 914015: https://vuldb.com/submit/914015
- NVD, CVE-2026-90607 (record status, CWE, CPE): https://nvd.nist.gov/vuln/detail/CVE-2026-90607
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Researcher write-up (GitHub, SunnyYANGyaya): https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formNewSchedule.md
- Totolink: https://www.totolink.net/