A critical buffer overflow vulnerability in the Totolink A3002MU router, specifically within the boa web server component, exposes the device to remote code execution and denial of service attacks.

This flaw is a buffer overflow (CWE-120) triggered by improper input validation of the ip6addr parameter within the /boafrm/formFilter endpoint. An authenticated attacker can provide an excessively long input string to overwrite memory, leading to system instability or potential code execution.

The CVSS score of 9.9 underscores the extreme severity of this vulnerability, as it allows for full system compromise, including the potential for remote code execution. A successful exploit could lead to complete loss of router control, interception of network traffic, and unauthorized access to internal network resources, posing a significant risk to organizational data integrity and availability.

Immediate Action: Since no official patch is currently available, users should restrict administrative access to the router management interface to trusted internal IP addresses only. Disable remote management features if they are not strictly required for operations.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /boafrm/formFilter endpoint. Review device logs for unexpected process crashes or restarts of the boa web server.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP requests containing abnormally long strings within the ip6addr parameter. Ensure the router is isolated from the public internet using a secure VPN or firewall gateway.

Public Exploit Available: Yes, a published proof of concept exists, as documented in the research writeup provided by the vulnerability reporter.

Given the critical CVSS score and the public availability of exploit details, immediate action is required to secure affected Totolink devices. Administrators should prioritize restricting access to the management interface and monitor for vendor updates, applying the manufacturer firmware patch as soon as it is released.