A critical 9.9-rated bug just landed in a Totolink router - here's who should actually care
A newly published flaw in a budget router's web interface scores near the top of the CVSS scale, but the scary number hides a much narrower story.
A new vulnerability has been logged against the Totolink A3002MU router, and it’s been handed a CVSS score of 9.9 — about as severe as the scale gets. Before anyone panics, though, it’s worth being clear about exactly what’s been confirmed, and what hasn’t.
What the bug actually does
According to the NVD entry for CVE-2026-90608, the issue sits in a specific firmware build of the A3002MU (version Hh-B20211125.1046), inside the boa web server component that runs the router’s admin interface. The problem lives in a function called formPortFw, part of the code that handles port-forwarding settings, and involves mishandling of an input argument. The way that’s described lines up with a classic memory-corruption bug — the sort of flaw that, in the worst case, could let an attacker run their own code on the device rather than just crash it.
That’s the known part. What we don’t have, from the public record so far, is a full technical writeup confirming exactly how remotely exploitable it is, whether it needs valid login credentials to the router’s dashboard first, or a proof-of-concept demonstrating it working end to end. The 9.9 score reflects how NVD’s automated scoring treats the flaw’s theoretical impact, not necessarily how easy it is to pull off in practice.
So who is actually at risk
This is not a Windows, Android or iPhone story. It affects one specific router model from Totolink, a brand better known in parts of Asia and the budget end of the market than in mainstream UK retail, running one particular firmware version. If you don’t own an A3002MU, this simply doesn’t touch you.
Even for owners of that router, the practical risk hinges on things the current disclosure doesn’t spell out: whether the vulnerable formPortFw function is reachable without logging in first, and whether the router’s admin panel is exposed to the wider internet rather than just the home network. Plenty of consumer routers ship with remote management switched off by default, which would limit an attacker to someone already on the same Wi-Fi. That’s a meaningfully smaller threat than “anyone on the internet can take over your router.”
There’s also no evidence yet, in what’s been published, that this is being exploited in the wild. It’s a freshly disclosed flaw, not an active attack campaign.
What to do about it
If you do run a Totolink A3002MU, the sensible checks are straightforward: log into the router’s admin panel and see whether a firmware update is available, and if not, keep an eye on Totolink’s support channels for a fix. In the meantime, turning off remote/WAN access to the admin interface (if it’s enabled) removes the most dangerous version of this attack path, leaving only someone already inside your home network as a potential risk.
For everyone else, this is a useful reminder rather than a reason to worry: routers running obscure, rarely-updated firmware are a genuine soft spot in home networks, and headline CVSS scores don’t always translate into an immediate, practical threat to your own setup.
The takeaway
A serious-sounding bug has been disclosed in a niche router model, with several important details — patch availability, real-world exploitability, exposure numbers — still unconfirmed. If you own the affected device, check for an update and lock down remote access. If you don’t, there’s nothing here that needs your attention today.