CVE-2026-90606

CRITICAL 9.9CVE-2026-90606 · Published 14/09/2026 · updated 15/09/2026

In short

CVE-2026-90606 is a CRITICAL (CVSS 9.9) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.85%, higher than 58.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static_ipv6 leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

References

SunnyYANGyaya/cuicuishark-sheep-fishIOT
vuldb.com/cve/CVE-2026-90606
vuldb.com/submit/914010
vuldb.com/vuln/403188
vuldb.com/vuln/403188/cti
totolink.net

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free