CVE-2026-90605
A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
- EPSS probability
- 0.47%
- CWE
- CWE-120, CWE-119
- Published
- 2026-09-13
- Last modified
- 2026-09-15
Affected products
- Totolink A3002MU
Weakness type
Related vulnerabilities
- CVE-2026-82542 — Tenda HG10 Boa Web Server formIPv6Routing buffer overflow
- CVE-2026-44756 — Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing
- CVE-2026-17040 — Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-55209 — resdata insufficiently validates untrusted GRDECL files
- CVE-2025-12686 — Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStati
- CVE-2026-90608 — Totolink A3002MU boa formPortFw buffer overflow
- CVE-2026-90606 — Totolink A3002MU boa formIpv6Setup buffer overflow
- CVE-2026-87931 — Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow