A critical buffer overflow vulnerability in the Totolink A3002MU router, identified in firmware version Hh-B20211125.1046, poses a severe risk of remote code execution and system instability.

This is a memory corruption vulnerability caused by a buffer overflow in the formPortFw function of the boa web server component. An authenticated attacker can trigger the flaw by sending a crafted HTTP POST request containing an excessively long value in the service_type parameter.

The vulnerability carries a CVSS score of 9.9, indicating a critical risk to business operations. Successful exploitation could lead to a complete denial of service of the networking equipment or unauthorized code execution, potentially allowing an attacker to gain full control over the router, intercept network traffic, or pivot into the internal network infrastructure.

Immediate Action: Since no official patch is currently available, administrators should restrict management interface access to trusted IP addresses only and disable remote management features.

Proactive Monitoring: Monitor device logs and network traffic for unusual POST requests directed at the /boafrm/formPortFw endpoint, which may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall or network-based access control list to inspect and block malformed HTTP requests containing abnormally large parameters.

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up provided via GitHub.

Given the critical severity of this vulnerability and the availability of public proof-of-concept code, immediate action is required to harden the device configuration. Administrators must prioritize isolating the affected hardware from untrusted network segments and remain vigilant for vendor-supplied firmware updates to permanently remediate the underlying memory safety flaw.