CVE-2026-90606

A vulnerability has been detected in Totolink A3002MU version 1.0.0-B20230403.1455. It affects an unknown function in the file /boafrm/formIpQoS of the QoS Rule Handler component. Manipulation of the addQos/comment/entry_name arguments leads to a stack-based buffer overflow. The attack can be performed remotely, and the exploit has been publicly disclosed.

A weakness has been identified in Totolink A3002MU version 1.0.0-B20230403.1455. It affects the function sub_40FCFC in the file /bin/boa of the Authentication Check component. Executing a manipulation can lead to improper authorization. The attack can be launched remotely, and the exploit has been made publicly available.

A vulnerability has been identified in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWsc function of the /boafrm/formWsc file. Manipulation of the localPin argument leads to command injection. The attack can be launched remotely, and a public exploit is already available.

A vulnerability has been discovered in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWlWds function of the /boafrm/formWlWds file. Manipulation of the submit-url argument results in a buffer overflow. The attack can be launched remotely, and a public exploit has already been released.

A buffer overflow vulnerability was identified in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlEncrypt function of the /boafrm/formWlEncrypt file. Manipulation of the submit-url argument allows remote exploitation. The exploit is publicly available and may be used.

A buffer overflow vulnerability was determined in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlAc function of the /boafrm/formWlAc file. Manipulation of the submit-url argument can lead to a buffer overflow. The attack may be performed remotely, and the exploit has been publicly disclosed.

A buffer overflow vulnerability was found in the Totolink A3002MU (version Hh-B20211125.1046) within the formSchedule function of the /boafrm/formSchedule file. Manipulation of the webpage argument results in a buffer overflow. The attack is possible remotely, and the exploit has been made public.

A buffer overflow vulnerability was found in Totolink A3002MU version Hh-B20211125.1046, in the formPortFw function of /boafrm/formPortFw (boa component). Manipulating the service_type argument causes the overflow. The attack can be initiated remotely and the exploit has been published.

A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formNewSchedule function of /boafrm/formNewSchedule (boa component). Manipulating the submit-url argument results in the overflow. The attack may be performed remotely and the exploit is now public.

A buffer overflow weakness was identified in Totolink A3002MU version Hh-B20211125.1046, in the formFilter function of /boafrm/formFilter (boa component). Manipulating the ip6addr argument leads to the overflow. The attack can be executed remotely and the exploit has been made available to the public.