CVE-2026-90605: Totolink A3002MU boa formFilter buffer overflow
Published Sep 13, 2026
·Updated
A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
1 affected component
TOTOLINK Totolink A3002MU=Hh-B20211125.1046
Event History
Sep 13, 2026
CVE Published
via MITRE·11:30 PM
Data Sourced
via MITRE·11:30 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attack can be executed remotely and requires low privileges. No user interaction is required.
2
Which deployments are known to be affected?
The affected product identified in the available data is Totolink A3002MU running Hh-B20211125.1046. The vulnerability is in the boa component's /boafrm/formFilter handler.
3
Is exploit code available?
Yes. A public exploit has been made available, which increases the likelihood of exploitation attempts.