Critical 9.9-rated bug found in Totolink router firmware - but check if it even affects you first

A newly published vulnerability tracked as CVE-2026-90605 has landed with a CVSS score of 9.9, which is about as bad as these ratings get. The catch, as ever, is working out who actually has a router affected by it, because the answer here is: a fairly small slice of people, running a fairly specific device.

What the bug actually does

According to the NVD entry for CVE-2026-90605, the flaw sits in the formFilter function inside /boafrm/formFilter, part of the “boa” web server component used on the Totolink A3002MU router running firmware version Hh-B20211125.1046. In plain terms, this is the bit of code that handles a settings page in the router’s web admin panel. The listing describes a “manipulation” of this function that triggers the vulnerability, which typically means an attacker can send it crafted input to make it do something it shouldn’t — anything from crashing the device to running arbitrary commands on it, depending on exactly how the flaw behaves.

The Boa web server, for context, is old, lightweight software that’s been discontinued for years but still turns up baked into firmware on cheap routers and IoT gear across multiple manufacturers, not just Totolink. It has a long history of security holes precisely because nobody’s actively maintaining it any more.

So who is actually at risk

This is where the “critical” headline number needs a reality check. The vulnerability is specific to one router model — the Totolink A3002MU — running one particular firmware build. If you don’t own that device, this bug doesn’t touch you, full stop.

For those who do, the practical risk depends on how the flaw is actually triggered. Router admin panels are usually only reachable from inside your home network, not the open internet, unless remote management has been switched on (which some ISPs or users do without realising the risk). The NVD listing doesn’t confirm whether this bug requires authentication to exploit, whether it’s reachable remotely, or whether anyone has actually used it in an attack yet. None of that has been established in what’s publicly available right now — so treat the 9.9 score as a description of potential damage if the worst-case exploitation path holds up, not proof that attacks are happening.

It’s also worth noting Totolink is a budget router brand more common in parts of Asia than in UK homes, so the practical UK footprint of the A3002MU specifically is likely to be modest.

What to do about it

• Check whether you actually own a Totolink A3002MU before doing anything else — most readers won’t.
• If you do, log into the router’s admin panel and check the firmware version against Hh-B20211125.1046.
• Look on Totolink’s support site for a newer firmware release; there’s no confirmation yet that a patch exists for this specific issue.
• Turn off remote/WAN access to the router’s admin interface if it’s enabled, and make sure the admin password isn’t still the factory default.
• If in doubt, isolating or replacing an old, unsupported router is generally sound practice regardless of any one CVE.

The takeaway

A CVSS of 9.9 sounds alarming, and for the tiny number of people running this exact router on this exact firmware, it’s worth a firmware check and a look at remote-access settings. For everyone else, this is a routine disclosure about an obscure device running old server software with a well-known history of holes — not a reason to lose sleep over your own kit.