Cyber & AI intelligence
Wasteland.
Briefs indexed2597
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-90607 2026-09-13

Totolink A3002MU Buffer Overflow (CVE-2026-90607) Has a Public Exploit

"A remote buffer overflow in the Totolink A3002MU router's boa web server carries a CVSS 3.1 score of 9.9 and already has publicly available exploit code."

A remote buffer overflow in the Totolink A3002MU router's boa web server carries a CVSS 3.1 score of 9.9 and already has publicly available exploit code.

What Is It

CVE-2026-90607 is a buffer overflow in the formNewSchedule function of the file /boafrm/formNewSchedule, part of the boa component on the Totolink A3002MU router. Manipulation of the submit-url argument triggers the overflow. The attack can be performed remotely, and the exploit is now public and may be used.

The vulnerability is classified under CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (classic buffer overflow). It was assigned by the VulDB CNA and currently carries a vulnerability status of "Received," meaning the record has not yet been analyzed or enriched.

Why It Matters

The CVSS 3.1 base score is 9.9 (CRITICAL), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That combination is the dangerous one: network reachable, low attack complexity, no user interaction, and only low privileges required. The scope is marked Changed, and confidentiality, integrity, and availability impacts are all High.

A CVSS 4.0 assessment from the same source scores it 8.6 (HIGH), with exploit maturity rated Proof-of-Concept. The legacy CVSS 2.0 score is 9.0. Public proof-of-concept code lowers the bar for opportunistic attacks against exposed devices.

What's Vulnerable

No other products or firmware versions are currently listed as affected.

Patch Status

CVE-2026-90607 does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmation of exploitation in the wild and no KEV-mandated remediation deadline for federal agencies. No patch, fixed version, vendor advisory, or recommended mitigation has been published. The only vendor-related reference available is the Totolink homepage.

Operators running the A3002MU should treat the device's web interface as untrusted: restrict management access to trusted local networks, ensure the router's administrative interface is not reachable from the internet, and monitor for a vendor firmware release.

Sources