CVE-2026-90604

Executive Summary

CVE-2026-90604 is a cross-site scripting (XSS) vulnerability in the Totolink A3002MU wireless router running firmware build Hh-B20211125.1046, affecting an unspecified code path within the device's "Anchor Tag Handler" component. An attacker able to supply manipulated input to the affected handler can inject script content that executes in the context of a victim's authenticated session against the router's web management interface, degradating the integrity of user-facing content. The vulnerability is remotely reachable, publicly disclosed with exploit code released, and — critically — no patch currently exists from the vendor or any tracked source, leaving all devices at this firmware level exposed.

The CVSS v3.1 base score is 3.5 (Low), reflecting a network-vector, low-complexity attack that requires low privileges and user interaction, with only integrity impact at the scoped level and no confidentiality or availability impact. Importantly, the low base score understates real-world risk: the NVD description explicitly states that exploit code has been released to the public, and CWE-79 context on an administrative interface frequently escalates into session hijacking, credential theft, and CSRF-chained router reconfiguration.

Technical Analysis

The NVD description characterizes this issue as follows: "A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks."

The classification is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Based on the described component name — "Anchor Tag Handler" — the vulnerable code path relates to server-side or client-side handling of HTML <a> (anchor) elements, where user-controllable input is rendered into an anchor tag's attribute or body without adequate output encoding or attribute-context escaping.

Vulnerability mechanism (class level):

1. A request parameter consumed by the Anchor Tag Handler is reflected into an <a> element (typically into href, a title attribute, or the link text) without contextual encoding.
2. Because anchor tags commonly populate href attributes, the classic exploitation surface is a javascript: URI scheme injection — clicking the crafted link executes attacker script in the origin of the router's management interface — or attribute-breaking injection that terminates the attribute and inserts an event handler or script element.
3. The device serves the page over its administrative HTTP interface; script executing in that origin inherits the victim's session cookies and any CSRF-relevant tokens visible to the page.

Attack surface: The Totolink A3002MU management web UI, reachable on the LAN by default and, in misconfigured deployments, exposed to the WAN. The vulnerability is remotely triggerable (AV:N) but requires the victim to be authenticated at a low-privilege level (PR:L) and to interact with the crafted request (UI:R), consistent with a reflected XSS requiring the victim to follow a link or submit a form.

Explicit limitations of this analysis: The NVD description does not disclose the exact parameter name, endpoint path, HTTP method, or encoding failure responsible. This report therefore describes the vulnerability at the class level and does not invent function names, URL paths, or parameter identifiers. No source code, firmware image diff, or patch exists in the provided data to support a code-level walkthrough.

The CVSS scope is Unchanged (S:U), meaning the vulnerable component and the impacted component are treated as the same security authority — here, the router's web UI origin. Impact is Integrity only (I:L), with no Confidentiality (C:N) and no Availability (A:N) impact per the numerical vector. This suggests the scored impact is limited to manipulation of displayed content within the same origin, though in practice XSS on an admin interface routinely enables actions beyond the scored scope (see Impact Assessment).

Exploitation Scenarios

No public proof-of-concept code artifact, Nuclei template, or Metasploit module is present in the supplied intelligence. The NVD description nevertheless states that "the exploit has been released to the public and may be used for attacks." The scenario below is constructed strictly from the vulnerability class (CWE-79) and the stated conditions (remote, low privilege, user interaction required). No specific endpoint, parameter, or function name is asserted because none is disclosed.

1. Reconnaissance / target identification An attacker identifies candidate Totolink A3002MU devices via internet-wide scanning using banners and page titles characteristic of the device's web interface (see Shodan dorks in METADATA). Targets of interest are devices whose management UI is reachable either from the WAN or from a network segment an attacker can influence (guest Wi-Fi, shared LAN, or a lure delivered to an authenticated administrator). Firmware build Hh-B20211125.1046 is the confirmed affected baseline.

2. Triggering the flaw class Because this is a reflected/stored XSS in an anchor tag handler, the attacker crafts a request or link in which the input that the Anchor Tag Handler renders is manipulated. At the class level, the manipulation places executable script — or a script-bearing URI scheme in an anchor href — into the generated markup. The exact injection vector (query parameter, form field, or stored value) is not specified in the available data.

3. Payload / execution method (class level) The victim, who holds a low-privilege authenticated session on the router UI, is induced to load the crafted request (via phishing link, cross-site request from a page the victim visits, or an injected link rendered to them). The browser parses the resulting anchor markup and executes the injected script in the origin of the router's web management interface. No attacker-specific payload is reproduced here, as none is provided.

4. Post-exploitation impact Consistent with CWE-79 on an administrative origin and the scored I:L integrity impact, an attacker can manipulate content rendered in the victim's session. Realistic downstream effects of XSS in a router admin origin — which extend beyond the narrowly scored subscores — include: reading page-visible session material, issuing authenticated requests on the victim's behalf (e.g., to change DNS, firewall, or port-forwarding settings via CSRF-style chained requests), and pivoting to further social engineering. These downstream effects are inferred from the vulnerability class, not enumerated in the source data.

Explicit caveat: No public PoC is available in this dataset; the attack chain is inferred from the vulnerability class. Specific code patterns, parameter names, and endpoints are intentionally not fabricated.

Impact Assessment

Affected systems: Totolink A3002MU routers at firmware Hh-B20211125.1046. Because the affected version has no confirmed successor or fix, the exposed population is effectively all devices running this build that expose the affected management interface. The A3002MU is a consumer/SOHO-class dual-band router commonly deployed in small offices, retail, and home environments — often with default or weak administrative credentials.

CVSS v3.1 subscores (3.5 / Low):

• AV:N (Network) — exploitable remotely; the attacker need not be on the local segment, though reachability of the UI is a precondition.
• AC:L (Low) — no special conditions or race windows required.
• PR:L (Low) — the victim holds low-level privileges/authenticated session.
• UI:R (Required) — the victim must interact with the crafted request.
• S:U (Unchanged) — impact confined to the same security authority.
• C:N / I:L / A:N — no confidentiality or availability impact scored; limited integrity impact.

Blast radius and business impact: The low base score should not drive deprioritization. Factors raising effective risk:

1. Public exploit code exists — lowering the skill barrier to weaponization.
2. Inherent exposure of router admin UIs — frequently reachable from guest networks or the WAN.
3. XSS on a network gateway is a high-leverage foothold: manipulation of the router's rendered configuration UI can be chained toward DNS manipulation, credential harvesting, and traffic redirection — outcomes whose business impact far exceeds a CVSS 3.5.
4. No patch and no vendor fix — exposure is indefinite without compensating controls.

Compounding risk with other flaws: Gateway devices are common targets for botnet recruitment and traffic interception. While CVE-2026-90604 alone scores Low, it must be assessed alongside any other unpatched issues on the same firmware, since chaining (XSS → authenticated action → config change) can elevate aggregate impact.

Detection Guidance

Note: The following rules are constructed at the vulnerability class level (reflected/stored XSS targeting a router management UI). They intentionally avoid asserting undisclosed endpoint or parameter names. Tune placeholders to your environment.

Sigma Rule

title: Totolink A3002MU Anchor Tag Handler XSS Attempt (CVE-2026-90604)
id: 9f6c1b2e-7a44-4d3e-9b21-90604aa3002m
status: experimental
description: Detects web requests to Totolink A3002MU management interface containing
  script-bearing payloads characteristic of anchor-tag XSS (CWE-79, CVE-2026-90604).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90604
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1189
  - attack.t1059.007
  - cve.2026.90604
logsource:
  category: webserver
  product: totolink
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_device:
    cs-uri-stem|contains:
      - '/cgi-bin'
      - '/boafrm'
      - '/web'
  selection_payload:
    cs-uri-query|contains:
      - 'javascript:'
      - 'onmouseover='
      - 'onerror='
      - 'onload='
      - '<script'
      - '%3Cscript'
      - 'alert('
      - 'prompt('
      - 'document.cookie'
  condition: selection_method and selection_device and selection_payload
falsepositives:
  - Legitimate administrative testing
  - Security scanners in authorized assessments
level: medium

YARA Rule

rule CVE_2026_90604_Totolink_A3002MU_XSS
{
    meta:
        description = "Detects anchor-tag XSS payloads targeting Totolink A3002MU (CVE-2026-90604)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90604"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a1 = "javascript:alert" ascii nocase
        $a2 = "javascript:prompt" ascii nocase
        $a3 = "javascript:confirm" ascii nocase
        $a4 = "document.cookie" ascii nocase
        $a5 = "onmouseover=" ascii nocase
        $a6 = "onerror=" ascii nocase
        $a7 = "<script>" ascii nocase
        $a8 = "A3002MU" ascii
        $a9 = "Totolink" ascii nocase

    condition:
        uint16(0) == 0x3C61 or
        (2 of ($a1,$a2,$a3,$a4,$a5,$a6,$a7) and 1 of ($a8,$a9)) or
        (3 of ($a1,$a2,$a3,$a4,$a5,$a6,$a7))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90604 Totolink A3002MU Anchor Tag XSS Attempt"; \
  flow:established,to_server; \
  http.method; content:"GET"; nocase; \
  http.uri; content:"javascript:"; nocase; \
  http.uri; content:"A3002MU"; nocase; \
  classtype:web-application-attack; \
  reference:cve,CVE-2026-90604; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90604; \
  metadata:created_at 2026_01_01, updated_at 2026_01_01; \
  sid:9060400; rev:1;)

alert http any any -> any any (msg:"CVE-2026-90604 Totolink XSS Script Tag in Query"; \
  flow:established,to_server; \
  http.method; content:"GET"; nocase; \
  http.uri; content:"%3Cscript"; nocase; \
  http.header; content:"Referer"; nocase; \
  classtype:web-application-attack; \
  reference:cve,CVE-2026-90604; \
  sid:9060401; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where
      http.request.method in ("GET", "POST") and
      http.request.uri : ("*javascript:*", "*<script*", "*%3Cscript*",
                          "*onmouseover=*", "*onerror=*", "*document.cookie*") and
      destination.port in (80, 443) ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri_stem)
| eval query=coalesce(uri_query, cs_uri_query)
| where match(lower(uri), "totolink|a3002mu|boafrm|cgi-bin")
| where match(lower(query), "javascript:|%3cscript|<script|onmouseover=|onerror=|onload=|document\.cookie|alert\(|prompt\(")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(query) as payloads
        by src_ip, dest_ip, uri
| where count > 0
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,totolink,cve-2026-90604,">
  <rule id="906040" level="10">
    <if_sid>31100</if_sid>
    <match>javascript:|%3Cscript|<script|onmouseover=|onerror=|onload=|document.cookie</match>
    <description>CVE-2026-90604: Possible Totolink A3002MU anchor-tag XSS attempt detected in HTTP request.</description>
    <mitre>
      <id>T1189</id>
      <id>T1059.007</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, firmware update, or third-party fix exists in any tracked source. There is no reference fix to deploy, and no workaround is published by the vendor.

1. Immediate mitigations (do these now):

• Remove management interface from untrusted networks. Restrict the A3002MU admin UI to a trusted LAN only; disable WAN/remote management and any "cloud" or remote-access feature. Block inbound access to the UI at the perimeter firewall.
• Segment the device. Place the router/AP on an isolated management VLAN where practical; keep guest Wi-Fi fully separated from the management plane.
• Harden administrative access. Change default credentials, use strong unique passwords, and enforce re-authentication. Disable unused services (Telnet, UPnP/WAN admin).
• Treat the UI as untrusted for browsing. Administrators should not follow links to the router UI from email, chat, or other websites; navigate to the UI directly by bookmark.
• Deploy detections above (Suricata/Wazuh/Splunk) to catch javascript:, <script, and event-handler payloads in requests to the device UI. Note detections are class-level and require tuning.

2. Patch / upgrade steps:

• No patch is available. Monitor the Totolink support/download page and the NVD entry for CVE-2026-90604 for a firmware release; apply it immediately when published.
• If the vendor remains silent and no fix materializes, evaluate replacement of the affected model with a device under active security maintenance.
• Maintain an asset inventory of all A3002MU units at build Hh-B20211125.1046; without a patch, the only reliable "remediation" is replacement or network isolation.

3. Long-term hardening:

• Adopt a firmware lifecycle policy requiring vendor security-maintenance commitments for network edge devices; decommission EOL/unpatchable hardware.
• Centralize logging for all gateway device management interfaces and forward to the SIEM.
• Deploy an internal XSS/HTTP inspection capability for management traffic.
• Track CVE feeds for your device inventory (EPSS pending for this CVE) and treat public-exploit-available XSS on admin UIs as higher priority than its base score implies.

References

1. NVD — CVE-2026-90604: https://nvd.nist.gov/vuln/detail/CVE-2026-90604 (authoritative description; source of the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, score 3.5; status: public exploit released).
2. CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
3. MITRE ATT&CK — T1189 Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
4. Totolink official support / firmware download page: https://www.totolink.net (monitor for a future A3002MU firmware advisory — none identified to date).
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-90604 is NOT listed as of this report.

Exploit-in-the-wild / threat actor evidence: The NVD description states exploit code has been released to the public and may be used for attacks, but no specific threat actor, campaign, or observed in-the-wild exploitation is documented in the provided intelligence. EPSS has not yet been scored by FIRST.org — no EPSS value is asserted. Do not treat any actor attribution as confirmed; none is available.