CRITICAL

CVE-2026-90607

2026-09-14 CVSS v3.1

CVSS

9.9

Description

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.

Weakness (CWE)

CWE-119 Memory Buffer Bounds Error

CWE-120 Classic Buffer Overflow

EPSS Score

0.47%

Probability of exploitation in next 30 days

39.6th percentile

References

https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formNewSchedule.md https://vuldb.com/cve/CVE-2026-90607 https://vuldb.com/submit/914015 https://vuldb.com/vuln/403189 https://vuldb.com/vuln/403189/cti https://www.totolink.net/

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE