CRITICAL

CVE-2026-90608

2026-09-14 CVSS v3.1

CVSS

9.9

Description

A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument service_type causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Weakness (CWE)

CWE-119 Memory Buffer Bounds Error

CWE-120 Classic Buffer Overflow

EPSS Score

0.8%

Probability of exploitation in next 30 days

54.9th percentile

References

https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formPortFw.md https://vuldb.com/cve/CVE-2026-90608 https://vuldb.com/submit/914016 https://vuldb.com/vuln/403190 https://vuldb.com/vuln/403190/cti https://www.totolink.net/

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE