CRITICAL

CVE-2026-90606

2026-09-14 CVSS v3.1

CVSS

9.9

Description

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static_ipv6 leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Weakness (CWE)

CWE-119 Memory Buffer Bounds Error

CWE-120 Classic Buffer Overflow

EPSS Score

0.49%

Probability of exploitation in next 30 days

41.4th percentile

References

https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formIpv6Setup.md https://vuldb.com/cve/CVE-2026-90606 https://vuldb.com/submit/914010 https://vuldb.com/vuln/403188 https://vuldb.com/vuln/403188/cti https://www.totolink.net/

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE