A critical buffer overflow vulnerability in the Totolink A3002MU router firmware allows a remote attacker to execute arbitrary code or cause a denial of service.

This is a memory corruption vulnerability (CWE-120) occurring within the boa web server component. An authenticated attacker can send a crafted HTTP POST request to the /boafrm/formNewSchedule endpoint, specifically manipulating the submit-url parameter to overwrite adjacent memory, which can lead to system instability or arbitrary code execution.

The vulnerability carries a CVSS score of 9.9, indicating a critical risk of total system compromise. Successful exploitation could result in a full denial of service, rendering the network infrastructure unusable, or allow an attacker to gain unauthorized control over the router, facilitating further lateral movement within the connected network and potential data interception.

Immediate Action: Since no specific patch version is currently available, immediately restrict access to the web management interface to trusted administrative IP addresses only.

Proactive Monitoring: Monitor device logs for repeated crashes of the boa process or anomalous HTTP POST requests directed at the /boafrm/formNewSchedule endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block HTTP POST requests containing excessively long values in the submit-url parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up by the vulnerability reporter on GitHub.

Given the critical severity of this vulnerability and the availability of a public proof-of-concept, users must treat this as a high-priority risk. Administrators should isolate the device from external network access immediately and verify if the manufacturer has released updated firmware to address this memory corruption flaw. Failure to mitigate this issue leaves the device susceptible to remote compromise.