CVE-2026-90606

Executive Summary

CVE-2026-90606 is a remotely triggerable buffer overflow in the Totolink A3002MU consumer/SOHO router running firmware Hh-B20211125.1046. The flaw resides in the formIpv6Setup function exposed by the embedded boa web server at /boafrm/formIpv6Setup; unsanitized manipulation of the static_ipv6 argument overflows a fixed-size buffer. Successful exploitation yields full compromise of the device with CVSS base score 9.9 (Scope:Changed, High Confidentiality/Integrity/Availability), and the vulnerability is publicly disclosed with exploit code reportedly available, yet remains unpatched across all tracked sources.

Technical Analysis

The affected component is boa, a lightweight embedded HTTP server commonly deployed on consumer routers and IoT firmware. boa maps URL paths to CGI handlers via routing table entries. In this case, the path /boafrm/formIpv6Setup is bound to the handler function formIpv6Setup, which processes IPv6 WAN/LAN configuration parameters submitted from the router's administrative UI.

The vulnerable argument is static_ipv6, a parameter that carries an operator-supplied IPv6 static address into the configuration logic. The NVD description states that "the manipulation of the argument static_ipv6 leads to buffer overflow." This is a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) condition: a copy operation (typically strcpy, sprintf, sscanf, or a manual loop) writes attacker-controlled data into a stack or heap buffer without validating that the length of the input is smaller than the destination. Because static_ipv6 is expected to be a bounded IPv6 literal (maximum 45 characters in textual form including the null terminator), the internal destination buffer is almost certainly sized accordingly (e.g., 16, 46, or 64 bytes). Supplying an oversized string overruns the boundary.

Two operational characteristics matter for defenders:

1. Reachability. The description explicitly states "The attack is possible to be carried out remotely." The Boa endpoint is served over HTTP/HTTPS on the device's LAN/WAN interface. Whether the endpoint requires authentication depends on the device's admin-session handling; the CVSS vector sets PR:L, meaning the attacker must possess some level of credentials or an equivalent low-privilege foothold. This does not imply the attack is unexploitable — many consumer routers ship with default credentials (admin/admin) or expose unauthenticated boafrm handlers, and CSRF+credential reuse from a malicious page is trivial.

2. Overflow primitive. CVSS AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates a low-complexity, network-reachable memory-corruption bug with full impact across confidentiality, integrity, and availability, and a Scope change (impact escapes the vulnerable component into the host OS or sibling processes). In the embedded context this maps to arbitrary code execution as the Boa daemon user (typically root on Totolink firmware), enabling persistent backdooring of the router.

Insufficient technical detail available in the NVD description to determine the exact buffer size, whether the overflow is stack- or heap-based, whether stack canaries/NX/ASLR are enabled in the firmware, or the exact byte layout required for control-flow hijack. Researchers will need to extract the firmware, reverse the formIpv6Setup handler in the Boa binary, and confirm the destination buffer size and adjacent control data.

Exploitation Scenarios

The NVD description confirms public disclosure of exploit code. No specific PoC is bundled with this report; the attack chain below is inferred from the vulnerability class (remote buffer overflow in an unauthenticated/low-auth boa CGI handler) and the disclosure metadata.

1 — Reconnaissance / target identification. The attacker identifies Totolink A3002MU devices via internet-wide scanning. Fingerprinting relies on HTTP responses from the Boa server, the presence of the /boafrm/ routing prefix, the A3002MU model string in admin pages, or the SSL certificate subject on the management interface. Shodan/Censys queries such as http.html:"boafrm" or product:"TOTOLINK" surface candidate hosts.

2 — Triggering the flaw. The attacker issues an HTTP request (GET or POST) to /boafrm/formIpv6Setup carrying the static_ipv6 parameter. Instead of a syntactically valid IPv6 address, the parameter is set to a long string. The Boa CGI handler formIpv6Setup copies the value into a fixed-size destination buffer without bounds checking, overwriting adjacent memory. The NVD specifies "manipulation of the argument static_ipv6", confirming that the parameter itself — not the request path — is the injection point.

Because CVSS rates the vector as PR:L and AC:L, the request most likely needs to be authenticated (or the attacker must first obtain a session/credential via default creds or credential stuffing), but no exploitation-timing obstacles (race conditions, complex heap grooming) are indicated — the crash/heap-write occurs on a single well-formed request.

3 — Payload / execution. At the vulnerability-class level, the overflow is used to corrupt control data (a saved return address on the stack, a function pointer, or an allocator header) so that execution flow is redirected to attacker-controlled bytes. On MIPS/ARM embedded firmware the practical payloads are:

• ROP to call system()/execve() with a command string placed earlier in the request body, spawning a root shell listener (e.g., telnetd on a high port), or
• Overwriting a callback pointer inside the Boa context to divert execution on the next request.

The Scope:Changed rating in the CVSS vector strongly suggests the attacker can escape the Boa process boundary — consistent with boa running as root, in which case memory corruption directly yields system-level code execution. The exact offsets, gadget set, and payload encoding are not disclosed in the source data and must be derived from firmware analysis.

4 — Post-exploitation impact. With root code execution, an attacker can persist across reboots by writing to NVRAM or /etc/rc.local, exfiltrate Wi-Fi PSKs and stored PPPoE/VPN credentials, install DNS hijack rules to redirect LAN clients, pivot into the internal network past the router's firewall, or enroll the device into a botnet (Mirai-class). Availability is total: a malformed request can also brick the device via watchdog-triggered boot loops.

Impact Assessment

• Affected systems. Totolink A3002MU devices running firmware Hh-B20211125.1046. The A3002MU is a dual-band AC1200-class wireless router widely deployed in SOHO and consumer environments; no enterprise-hardened SKU exists. No additional products are named in the source data.
• CVSS subscores (9.9, Critical).
  • AV:N — exploitable over the network.
  • AC:L — no special conditions or timing windows required.
  • PR:L — attacker needs low privileges (a session / default credential / valid CSRF token path).
  • UI:N — no user interaction needed at exploitation time.
  • S:C — impact crosses a security boundary (Boa process → host OS / router firmware).
  • C:H — full read of configuration, credentials, and routed traffic.
  • I:H — arbitrary write to device configuration and firmware state.
  • A:H — full DoS capability; device can be made unavailable.
• Blast radius. Each vulnerable router is an internet-edge device. Compromise translates directly into: (i) LAN-wide traffic interception and MITM, (ii) credential theft against downstream endpoints, (iii) use as a bounce host for further attacks, and (iv) botnet conscription. In small businesses, a single A3002MU compromise can expose an entire flat network.
• Exploitability today. Public disclosure + publicly available exploit + zero patch evidence = urgent exposure. There is no EPSS score yet from FIRST.org, and the CVE is not in CISA KEV, but the combination of remote reachability, critical CVSS, and public exploit code makes this a high-priority triage item.

Detection Guidance

Because the endpoint /boafrm/formIpv6Setup is only legitimately hit by administrators saving IPv6 settings, detection can be tightly scoped to oversized static_ipv6 values and to boa/kernel crash telemetry.

Sigma Rule

title: Totolink A3002MU formIpv6Setup Buffer Overflow Attempt (CVE-2026-90606)
id: 3e1f8a42-7c5b-4c9e-9b0d-2f4a6c8e1d20
status: experimental
description: Detects HTTP requests targeting /boafrm/formIpv6Setup with an abnormally long static_ipv6 parameter, indicative of exploitation attempts against CVE-2026-90606.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90606
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: boa
detection:
  selection_uri:
    cs-uri-stem|endswith: '/boafrm/formIpv6Setup'
  selection_param:
    cs-uri-query|contains: 'static_ipv6='
  filter_length:
    cs-uri-query|re: 'static_ipv6=[A-Za-z0-9:%._\-]{1,45}(&|$)'
  condition: selection_uri and selection_param and not filter_length
fields:
  - c-ip
  - cs-uri-query
  - cs-method
  - sc-status
falsepositives:
  - Legitimate administrative configuration saves with well-formed IPv6 literals
level: high
tags:
  - attack.t1190
  - cve.2026.90606

YARA Rule

rule CVE_2026_90606_Totolink_formIpv6Setup
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP requests attempting buffer overflow via static_ipv6 on Totolink A3002MU (CVE-2026-90606)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90606"
        date = "2026-01-01"
        cve = "CVE-2026-90606"

    strings:
        $uri   = "/boafrm/formIpv6Setup" ascii nocase
        $param = "static_ipv6=" ascii nocase
        $long  = /static_ipv6=[A-Za-z0-9:%._\-]{60,}/ ascii

    condition:
        $uri and $param and $long
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90606 Totolink A3002MU static_ipv6 Buffer Overflow Attempt"; flow:established,to_server; http.uri; content:"/boafrm/formIpv6Setup"; http.uri; content:"static_ipv6="; pcre:"/static_ipv6=[A-Za-z0-9:%._\-]{60,}/Ui"; classtype:attempted-admin; reference:cve,2026-90606; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90606; metadata:affected_product Totolink_A3002MU, attack_target IoT, deployment Perimeter, signature_severity Critical, created_at 2026_01_01; sid:202690606; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method in ("GET", "POST")
      and url.path == "/boafrm/formIpv6Setup"
      and url.query : "static_ipv6=*" ]
  [ network where url.path == "/boafrm/formIpv6Setup" ]

Splunk SPL Query

index=network sourcetype=stream:http OR sourcetype=access_combined
| eval q=coalesce(uri_query, cs_uri_query, url)
| where match(uri_path, "^/boafrm/formIpv6Setup") OR match(q, "formIpv6Setup")
| rex field=q "static_ipv6=(?<ipv6val>[^&\s]+)"
| where len(ipv6val) > 45
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as sources values(ipv6val) as payloads by dest
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="totolink,web,cve_2026_90606,">
  <rule id="100906" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/boafrm/formIpv6Setup</url>
    <regex>static_ipv6=[A-Za-z0-9:%._\-]{60,}</regex>
    <description>CVE-2026-90606: Possible buffer overflow exploitation against Totolink A3002MU formIpv6Setup via static_ipv6</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, no fixed firmware version, and no workaround published by Totolink in any tracked source.

1 — Immediate mitigations (apply today)

• Remove internet exposure. Block inbound access to the A3002MU management interface (TCP/80, TCP/443, and any vendor OOB port) at the perimeter firewall. Boa management endpoints should never be reachable from untrusted networks.
• Segment the management plane. Place the router's admin UI on a dedicated, restricted VLAN; permit access only from a hardened jump host.
• Rotate and harden credentials. Change factory-default admin credentials, disable remote/WAN administration, and disable UPnP when not strictly required.
• Restrict /boafrm/ paths. If a reverse proxy sits in front of the device, deny all requests matching /boafrm/formIpv6Setup from sources outside the admin subnet.
• Deploy virtual patching. Enable the Suricata/Sigma/Wazuh rules above at the boundary so that pre-authentication attempts are dropped and alerted.

2 — Patch / upgrade steps

• There is no fixed firmware version identified from NVD, CNA, OSV, or vendor sources at the time of writing. Monitor the Totolink download/support portal for the A3002MU and its Hh- firmware train for a build newer than Hh-B20211125.1046.
• When a fixed build ships: back up the current configuration, verify the firmware signature/checksum, apply from a wired connection, and factory-reset the device after flashing to clear any residual backdoor state.
• If no patch materializes and the device cannot be retired, isolate it on a network where compromise cannot affect high-value assets.

3 — Long-term hardening

• EOL discipline. Consumer routers with no firmware cadence past end-of-support belong off the production network. Replace with vendor models that publish security advisories and maintain a CVE response program.
• Inventory and continuous monitoring. Maintain a firmware-version inventory; alert when new CVEs (e.g., this one) land and when the model is listed as EOL.
• Supply-chain posture. Track Boa-based routers as a class — embedded boa handlers with a long history of unbounded parameter copies (many prior CVEs) should be treated as a systemic risk category.
• Egress and DNS monitoring. Detect post-exploitation DNS hijack / beaconing from the router's own management IP as a compensating control.

References

1. NVD — CVE-2026-90606: https://nvd.nist.gov/vuln/detail/CVE-2026-90606
2. CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Totolink A3002MU product / support portal (vendor firmware downloads — monitor for a post-Hh-B20211125.1046 build): https://www.totolink.net/
5. CISA KEV catalog (currently does NOT list CVE-2026-90606; monitor for addition given public exploit availability): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / ITW note. No specific campaign, threat actor, or confirmed in-the-wild exploitation has been attributed in the source data. NVD states that "the exploit has been disclosed publicly and may be used," which historically correlates with rapid scanning and botnet enlistment of exposed SOHO routers. Treat all internet-facing A3002MU devices as potentially compromised pending firmware replacement.