A critical stack-based buffer overflow vulnerability in TOTOLINK A3300R firmware poses a significant risk of remote code execution.

The vulnerability exists within the setScheduleCfg function of the cstecgi.cgi script. An authenticated attacker can supply an overly long string to the recHour POST parameter, which fails to undergo proper length validation, ultimately leading to a stack-based buffer overflow when processed by the getScheduleCfg function.

Successful exploitation of this buffer overflow could allow an attacker to execute arbitrary code with the privileges of the affected service, potentially leading to full device compromise. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk that could result in unauthorized administrative access, persistent malware installation, or the use of the device as a pivot point within the internal network.

Immediate Action: Since a specific patch is not currently identified, restrict network access to the device management interface to trusted administrative IP addresses only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the cstecgi.cgi endpoint, particularly those involving the setScheduleCfg or getScheduleCfg functions with abnormally large payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) rule to inspect and drop incoming HTTP traffic containing excessively large values in the recHour parameter.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up provided via the referenced GitHub repository.

Users of the TOTOLINK A3300R are strongly advised to limit exposure by isolating the device management interface from the public internet. Until an official firmware update is released, prioritize the implementation of network-level filtering to prevent unauthorized access to the vulnerable CGI endpoint, as public proof-of-concept code is currently available and poses a credible threat.