Totolink A3002MU CVE-2026-90604

Exploitation requires the attacker to hold a low-privilege authenticated session on the Totolink A3002MU web management interface, as confirmed by PR:L in the CVSS 4.0 vector - fully unauthenticated exploitation is not indicated. Partial user interaction is required (UI:P), meaning a privileged victim such as an administrator must navigate to or load the page containing the injected payload after the attacker has submitted it. The vulnerable component is specifically the Anchor Tag Handler within the web UI; the exact management page or input field is not described beyond the VulDB report and GitHub PoC. Exploitation is further bounded by the need for network access to the router's management interface (AV:N), so attackers on the same LAN/WLAN segment or with access to WAN-side management are in scope, while attackers with no network path to the admin interface are not. No special firmware configuration or feature flag is documented as required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/E:P) scores a base of 5.1, reflecting meaningful but bounded risk: the attack requires authenticated access at low privilege and partial user interaction, ruling out fully unauthenticated or automated exploitation. Impact is confined to low-integrity effects on the vulnerable system with no confidentiality or availability consequences scored, and no subsequent-system impact. The presence of a publicly available proof-of-concept on GitHub (E:P) elevates this beyond a theoretical finding and is the single most significant risk amplifier. EPSS data is absent from the available intelligence, so base-rate exploitation probability cannot be quantified. KEV status is not confirmed, indicating no known active exploitation in CISA's tracking at the time of analysis. For budget SOHO routers like this - commonly deployed in small branch offices and home environments rather than hardened enterprise stacks - even a mid-sized municipal IT team in boleslawiec managing a population of legacy devices should treat any authenticated XSS in an admin panel as an escalation risk due to the realistic potential for session token theft from infrequently patched hardware. The November 2021 firmware timestamp compounds risk: the device is almost certainly unpatched and unlikely to receive a vendor fix.

An attacker with low-privilege credentials for the Totolink A3002MU web management interface submits a crafted anchor tag payload through the vulnerable handler, causing malicious JavaScript to be stored or reflected in the admin UI. When an administrator subsequently navigates to the affected page, their browser executes the injected script, potentially exfiltrating their session cookie or performing unauthorized configuration changes on their behalf. A public proof-of-concept demonstrating this technique is available on GitHub, making reproduction straightforward for any attacker with basic web security knowledge.