A critical buffer overflow vulnerability in the Totolink A3002MU router permits unauthenticated remote attackers to trigger a denial of service or achieve arbitrary code execution.

This is a memory corruption vulnerability caused by improper length validation in the formWlEncrypt function of the Boa web server. An unauthenticated remote attacker can supply a crafted HTTP POST request with an overlong submit-url parameter to overwrite adjacent memory, leading to a service crash or potential code execution.

The vulnerability carries a CVSS score of 10.0, reflecting its critical nature and ease of exploitation. Successful exploitation can lead to a complete denial of service of network infrastructure or provide an attacker with full control over the router, potentially resulting in unauthorized network access, data interception, and total loss of device integrity.

Immediate Action: Contact the vendor for firmware updates or security patches for the A3002MU model. If no patch is available, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor the device for unexpected reboots or service outages that may indicate a crash. Review web server logs for HTTP POST requests directed at the /boafrm/formWlEncrypt endpoint containing abnormally long parameter values.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System to block requests containing suspicious patterns or excessive lengths in the submit-url parameter. Isolate the management interface from the public internet using firewall rules.

Public Exploit Available: Yes, a functional proof-of-concept is documented in the technical write-up provided by the researcher on GitHub.

Given the critical severity of this vulnerability and the availability of a public proof-of-concept, users must treat this as a high priority. Until a vendor-supplied patch is installed, administrators should immediately disable remote access to the router management interface and implement strict network-level access controls to prevent exploitation.