A critical buffer overflow vulnerability in the Totolink A3002MU router allows remote attackers to crash the device web server, posing a severe risk to network availability.

This is a buffer overflow vulnerability (CWE-120) triggered by improper length validation of the static_ipv6 parameter within the /boafrm/formIpv6Setup interface. The vulnerability requires the attacker to have low-level access to the management interface to submit the crafted POST request.

Successful exploitation results in a denial of service, rendering the router management interface unresponsive and potentially disrupting network traffic flow for connected users. Given the CVSS score of 9.9, this vulnerability represents a critical risk to business continuity, particularly for organizations relying on these devices for secure network connectivity.

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor network logs for unusual POST requests directed at the /boafrm/formIpv6Setup endpoint, especially those containing excessively long string parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to inspect and block HTTP requests containing oversized payloads targeting the management interface.

Public Exploit Available: Yes, a published proof of concept exists, as documented in the technical write-up provided by the researcher on GitHub.

The severity of this vulnerability, combined with the availability of a public proof of concept, necessitates immediate defensive action. Organizations using the Totolink A3002MU should isolate the management interface from the public internet immediately and monitor vendor channels for the release of a firmware update to address the underlying memory corruption issue.