CVE-2026-90605

Executive Summary

CVE-2026-90605 is a critical buffer overflow vulnerability in the Totolink A3002MU router firmware (Hh-B20211125.1046). The flaw resides in the formFilter function accessible via /boafrm/formFilter within the boa web server component, and is triggered by manipulation of the ip6addr argument. Successful exploitation allows remote authenticated attackers to achieve a scope-changing impact (S:C) with high confidentiality, integrity, and availability consequences, as reflected by the CVSS 3.1 score of 9.9. No official patch exists, and no public proof-of-concept or Nuclei template has been observed, but the exploit has been made available to the public according to the NVD description, raising the urgency for immediate mitigation.

Technical Analysis

The vulnerability is classified as CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. It specifically affects the boa web server component of the Totolink A3002MU firmware. The formFilter function, which handles requests to the /boafrm/formFilter endpoint, processes the ip6addr argument without adequate bounds checking, resulting in a buffer overflow when a crafted, oversized value is supplied. The attack vector is network-accessible (AV:N) and requires low privileges (PR:L), meaning the attacker must be authenticated to the device's web interface. The scope is changed (S:C), indicating the overflow can affect resources beyond the vulnerable component, such as other processes or the kernel. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) confirms high impact across confidentiality, integrity, and availability. No further technical details such as exact buffer size, offset, or exploitation primitives are publicly available; the description is limited to the function, file, and argument names. This is a classic stack or heap-based buffer overflow in an embedded HTTP server handling a specific parameter, common in IoT devices where input validation is insufficient.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker scans for internet-facing Totolink A3002MU devices using Shodan dorks such as http.title:"Totolink" or http.html:"boa". The device's web interface is typically exposed on TCP port 80 or 443. The attacker identifies the firmware version by fingerprinting the login page or HTTP headers.
2. Authentication: The attacker must possess valid credentials (PR:L). This could be obtained via default credentials, credential stuffing, or prior compromise. The boa web server requires authentication to access the /boafrm/formFilter endpoint.
3. Triggering the flaw: Once authenticated, the attacker sends a crafted HTTP request to /boafrm/formFilter with the ip6addr parameter set to an oversized string. The formFilter function fails to validate the length of ip6addr, causing a buffer overflow. The exact payload structure (e.g., POST body or query string) is not detailed in the description; however, the attack is a direct parameter manipulation.
4. Payload/execution method: The overflow can overwrite adjacent memory, potentially leading to arbitrary code execution or denial of service. Because the scope is changed, the attacker may gain control over other processes or the kernel. The public exploit availability suggests a weaponized payload may exist, but no PoC code is provided in the tracked data.
5. Post-exploitation impact: Successful exploitation could allow the attacker to execute arbitrary commands with elevated privileges, pivot into the internal network, intercept traffic, or render the device inoperable. The high CVSS impact scores indicate total loss of confidentiality, integrity, and availability of the device and potentially connected systems.

No public PoC is available; the attack chain is inferred from the vulnerability class and the sparse description. The lack of a Nuclei template or exploit code in tracked sources does not diminish the risk, as the NVD states the exploit has been made available to the public.

Impact Assessment

The vulnerability affects Totolink A3002MU routers running firmware Hh-B20211125.1046. These devices are often deployed in small office/home office (SOHO) environments, retail, and branch locations, making them attractive targets for botnet recruitment and lateral movement. The CVSS score of 9.9 with scope change (S:C) indicates that a compromise can extend beyond the vulnerable component, potentially allowing attackers to control the entire device, intercept network traffic, or use it as a pivot point into the internal network. The blast radius includes any network segment the router serves, as well as any devices trusting the router for DNS, DHCP, or firewall functions. The high confidentiality, integrity, and availability impact (C:H/I:H/A:H) means sensitive data could be exfiltrated, configurations altered, and services disrupted. Given the lack of a patch, the device remains vulnerable indefinitely unless mitigated.

Detection Guidance

Sigma Rule

title: Potential Totolink A3002MU formFilter Buffer Overflow Exploitation
id: 8f3c2a1e-5b7d-4c9a-9e2f-1a3b4c5d6e7f
status: experimental
description: Detects HTTP requests to /boafrm/formFilter with unusually long ip6addr parameter, indicative of CVE-2026-90605 exploitation.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  category: webserver
  product: boa
detection:
  selection:
    cs-method: 'POST'
    c-uri: '/boafrm/formFilter'
    cs-uri-query|contains: 'ip6addr='
  filter:
    cs-uri-query|re: 'ip6addr=[^&]{100,}'
  condition: selection and filter
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate configuration with very long IPv6 address (unlikely)
level: critical

YARA Rule

rule CVE_2026_90605_Totolink_FormFilter_Overflow
{
    meta:
        description = "Detects HTTP requests exploiting CVE-2026-90605 in Totolink A3002MU formFilter"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90605"
        severity = "critical"
    strings:
        $uri = "/boafrm/formFilter"
        $param = "ip6addr="
        $overflow = /ip6addr=[A-Za-z0-9:%.]{200,}/
    condition:
        $uri and $param and $overflow
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90605 Totolink A3002MU formFilter Buffer Overflow Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/boafrm/formFilter"; http_uri; content:"ip6addr="; http_client_body; pcre:"/ip6addr=[^&]{200,}/Ri"; reference:cve,2026-90605; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

sequence by source.ip
  [http where url.path == "/boafrm/formFilter" and http.request.method == "POST"]
  [http where url.path == "/boafrm/formFilter" and url.query contains "ip6addr=" and length(url.query) > 200]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri="/boafrm/formFilter" method=POST
| regex form_data="ip6addr=(?<ip6addr>[^&]{200,})"
| table _time, src_ip, uri, ip6addr, user_agent
| where len(ip6addr) > 200

Wazuh OSSEC Rule

<group name="totolink,cve-2026-90605,">
  <rule id="100100" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>/boafrm/formFilter</match>
    <regex>ip6addr=[^&]{200,}</regex>
    <description>CVE-2026-90605: Possible Totolink A3002MU formFilter buffer overflow attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Isolate affected devices from the public internet by placing them behind a firewall or VPN.
   • Disable remote management and UPnP if not required.
   • Change default credentials and enforce strong, unique passwords.
   • Monitor web server logs for requests to /boafrm/formFilter with abnormally long ip6addr parameters.
   • Apply virtual patching via WAF or IDS/IPS rules (as provided in Detection Guidance) to block exploit attempts.

2. Patch/upgrade steps:

   • No vendor patch is available. Contact Totolink support for firmware updates and monitor their advisory page.
   • If a patched firmware version is released, upgrade immediately. Until then, consider replacing the device with a supported model.

3. Long-term hardening:

   • Implement network segmentation to limit the blast radius of compromised IoT devices.
   • Regularly audit firmware versions and apply updates promptly.
   • Use endpoint detection and response (EDR) or network detection and response (NDR) to identify anomalous behavior from routers.
   • Conduct periodic vulnerability scans to detect unpatched devices.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90605
• Totolink Official Website: https://www.totolink.net/ (monitor for security advisories)
• CWE-119: https://cwe.mitre.org/data/definitions/119.html
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS: https://www.first.org/epss/ (score not yet available)