The vulnerability CVE-2026-90608 affects the Totolink A3002MU router firmware version Hh-B20211125.1046. It is located in the formPortFw function within the /boafrm/formPortFw component of the boa service. The issue is a buffer overflow caused by manipulation of the service_type argument, which can be exploited remotely without user interaction or elevated privileges. The CVSS 4.0 base score is 9.4, reflecting critical severity with high impact on confidentiality, integrity, and availability. Exploit code has been published, increasing the risk of exploitation.

Successful exploitation of this buffer overflow vulnerability can lead to remote code execution or denial of service on the affected device. The high CVSS score indicates severe impact on system confidentiality, integrity, and availability. Since the attack vector is network-based and requires no user interaction, the vulnerability poses a significant risk to affected devices exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network-level protections such as restricting access to the device's management interface and applying firewall rules to limit exposure may reduce risk. Monitor vendor channels for updates and apply patches promptly once released.