CVE-2026-90605
CVSS
9.9 Critical
2026-09-14
Totolink A3002MU boa component formFilter function remote buffer overflow leading to remote code execution
In Totolink A3002MU firmware version Hh-B20211125.1046, the formFilter function in the /boafrm/formFilter file of the boa component has a security defect. The vulnerability stems from a lack of effective bounds checking when handling the ip6addr parameter; an attacker can manipulate that parameter to trigger a buffer overflow (CWE-119). Because the attack vector is network-based and complexity is low, an attacker can remotely exploit this vulnerability to execute arbitrary code. Exploit code is already public, and the vulnerability may be used in automated attacks against affected devices, severely threatening confidentiality, integrity and availability.
The vulnerability affects all Totolink A3002MU devices running Hh-B20211125.1046 firmware. An attacker can launch the attack remotely without user interaction; successful exploitation may result in complete device control.
Component
Totolink A3002MU is a wireless router whose firmware includes the boa component for handling form requests on the Web management interface.
Risks
- Remote code execution: An attacker can use public exploit code to craft a malicious request that triggers a buffer overflow and execute arbitrary instructions on the device.
- Complete system control: Because the vulnerability has a wide impact and high exploitability, an attacker may obtain the highest privileges on the device, then steal sensitive data, tamper with configuration or enroll it in a botnet.
- No user interaction required: The attack can be launched directly over the network; the victim needs no additional action to be compromised.
Source
Remediation
- If an immediate upgrade is not possible, deploy an intrusion-detection system (IDS) at the network boundary to monitor anomalous traffic targeting the /boafrm/formFilter interface, especially requests containing malformed ip6addr parameters.
- Restrict access to the router management interface, allowing only trusted IP addresses, to reduce the remote attack surface.
CVE-2026-90680
CVSS
9.9 Critical
2026-09-14
D-Link DIR-823G HNAP1 strcpy stack overflow leading to remote code execution
In D-Link DIR-823G version 1.0.2B05_20181207, the /HNAP1/SetStaticRouteSettings interface of the HNAP1 component lacks bounds checking in the strcpy function, resulting in a stack buffer overflow (CWE-119) security defect. By manipulating the PAddress, SubnetMask or Gateway parameters, an attacker can trigger stack-memory overwrite, threatening device stability and security. The router has a memory-corruption vulnerability in certain network-configuration scenarios; an attacker can trigger it by crafting a malicious network request, leading to remote code execution or service interruption. The vulnerability affects all D-Link DIR-823G users running 1.0.2B05_20181207 firmware. An attacker only needs to send a remote request to complete exploitation, with no user interaction required, and can remotely control the device.
Component
D-Link DIR-823G is a wireless router; HNAP1 is its network API component for remote management and configuration.
Risks
- From ordinary user to administrator: If an attacker successfully exploits this vulnerability, they can obtain complete control of the router, equivalent to administrator privileges
- Complete system control: An attacker can use this vulnerability to execute arbitrary code on the router, and depending on privileges, modify network configuration, view/change/delete data or create a new account with full privileges
- No user-interaction attack: Through a remote network request (T1189), an attacker can trigger the vulnerability without the user clicking or interacting, achieving remote control
Source
Remediation
- Monitor anomalous request logs for the HNAP1 interface
- Enable access-control list (ACL) restrictions on the router management interface
- Block SetStaticRouteSettings calls from untrusted sources
