A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046.

CVE-2026-90606 is a stack buffer overflow in the formIpv6Setup handler (/boafrm/formIpv6Setup) of the boa embedded web server on the Totolink A3002MU running firmware Hh-B20211125.1046. Overflowing the static_ipv6 parameter gives an attacker code execution on the MIPS-based router. The firmware dates to November 2021 and no patch has been released; the device appears end-of-life. A public PoC exists. Three sibling CVEs (CVE-2026-90604, -90605, -90608) target different handler functions in the same firmware image, confirming the entire boa codebase is riddled with unchecked strcpy/sprintf calls.

The vendor CVSS of 9.9 CRITICAL is technically defensible *for the device itself* — remote, low-complexity, scope-change to the LAN behind it. But for an enterprise defender managing 10,000 endpoints, the score is wildly misleading. The Totolink A3002MU is a budget Chinese consumer WiFi router sold at ≈$30 retail. It does not appear in any enterprise procurement catalog, is not a managed network appliance, and has effectively zero installed base inside corporate networks. PR:L means the attacker still needs valid credentials to the router's admin panel, and the management interface is LAN-only by default. Even in a remote-worker home-router scenario, the blast radius is one employee's home network — not your domain.

Why this verdict

• Zero enterprise footprint: The Totolink A3002MU is a budget consumer SOHO router. It does not appear in enterprise procurement, is not a managed network appliance, and has no presence in corporate asset inventories. For a team managing 10,000 hosts, the affected population is effectively zero.
• Role multiplier: not applicable. This device does not occupy any high-value enterprise role. It is not a domain controller, hypervisor, identity provider, CI/CD server, backup appliance, or network edge firewall. It is a home WiFi router. Even in the worst case (a remote worker's home router), compromise does not grant access to corporate domain infrastructure — VPN tunnels bypass the home router's control plane. Blast radius: one home LAN segment.
• Authentication required (PR:L): Even on the device itself, the attacker needs valid credentials to the boa admin panel. Default creds (admin/admin) lower this bar, but the attacker must first reach the LAN-only management interface.
• No enterprise detection or patching path: The device is unmanaged by enterprise MDM/NAC. You cannot patch it, you cannot monitor it, and you should not be spending vulnerability management cycles on it.

Why not higher?

To rate this MEDIUM or above, the device would need meaningful enterprise deployment — e.g., if it were a managed access point or network edge appliance in branch offices. It is not. The high-value role floor does not apply because the Totolink A3002MU does not occupy any cataloged enterprise role. Even in home-office scenarios, corporate traffic flows through VPN tunnels that bypass the router's data plane.

Why not lower?

A public PoC exists and the device is unpatchable (EOL). If a remote worker *does* use one of these routers without VPN, their local traffic is at risk. That slim possibility keeps this from IGNORE. Additionally, IoT/SOHO router botnets (Mirai descendants) do actively recruit these devices, which could generate nuisance traffic or be used as proxy infrastructure.

1. Confirm zero inventory of Totolink A3002MU on corporate networks — Run an asset discovery scan (NAC, network inventory, or Shodan/Censys against your own IP space) to verify no Totolink devices exist on managed segments. This is a one-time check, not an ongoing control.
2. Enforce always-on VPN for remote workers — If any remote employees use consumer-grade routers, ensure corporate traffic is tunneled through a managed VPN concentrator, rendering the home router's compromise irrelevant to enterprise data. This is a standing policy, not CVE-specific.
3. Block Totolink devices via NAC policy — Add Totolink OUI (MAC prefix) to your NAC deny list so rogue consumer routers cannot join corporate wired or wireless segments.

Run this on any Linux/macOS auditor workstation with nmap installed to scan a target network for Totolink boa web servers. Invoke: bash check_totolink.sh 192.168.1.0/24. No special privileges required beyond network reachability.

#!/usr/bin/env bash
# check_totolink.sh — Scan a subnet for Totolink A3002MU boa web servers
# Usage: bash check_totolink.sh <CIDR>
# Exit codes: 0 = VULNERABLE (Totolink found), 1 = PATCHED/NOT_FOUND, 2 = UNKNOWN/error

set -euo pipefail

SUBNET="${1:-}"
if [[ -z "$SUBNET" ]]; then
  echo "Usage: $0 <CIDR>  e.g. $0 192.168.1.0/24"
  exit 2
fi

if ! command -v nmap &>/dev/null; then
  echo "UNKNOWN — nmap not installed"
  exit 2
fi

echo "[*] Scanning $SUBNET for boa web servers on ports 80,8080..."
RESULT=$(nmap -p 80,8080 --open -sV --version-intensity 5 "$SUBNET" 2>/dev/null)

if echo "$RESULT" | grep -qi 'boa.*totolink\|TOTOLINK\|A3002MU'; then
  echo "VULNERABLE — Totolink A3002MU boa web server detected on network"
  echo "$RESULT" | grep -B5 -i 'totolink\|boa\|A3002'
  exit 0
else
  echo "PATCHED — No Totolink A3002MU devices found on $SUBNET"
  exit 1
fi

Sources

1. VulDB — CVE-2026-90606 Advisory
2. OpenCVE — CVE-2026-90606
3. Shenlong CVE Platform — A3002MU Buffer Overflow Analysis
4. OffSeq Threat Radar — CVE-2026-90606
5. Strix.ai — CVE-2026-90606 Memory Corruption
6. SecNews.gr — Totolink A3002MU Three New Vulnerabilities
7. THREATINT — CVE-2026-90606