A critical buffer overflow vulnerability in Totolink A3002MU routers enables remote attackers to crash the device or execute arbitrary code without authentication.

This is a memory corruption flaw (CWE-120/119) located in the /boafrm/formWlWds interface of the Boa web server. An unauthenticated remote attacker can supply an excessively long string to the submit-url parameter, which is copied into a fixed-size buffer without length validation, leading to memory overwrite.

Successful exploitation poses a severe risk to network availability and integrity. Because the vulnerability is remotely exploitable without authentication, an attacker can crash the router, resulting in a complete denial of service for all connected clients. Given the CVSS score of 10.0, this flaw represents the highest level of risk, potentially allowing an attacker to gain control over the device and intercept or manipulate network traffic.

Immediate Action: Contact Totolink support immediately to verify if a firmware patch is available for your specific unit, as no official fixed version is currently documented. If no patch exists, disconnect the device management interface from the public internet immediately.

Proactive Monitoring: Review device logs for unusual POST requests directed at the /boafrm/formWlWds endpoint and monitor for unexpected router reboots or service interruptions.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to block incoming HTTP requests containing excessively long submit-url parameters. Ensure the router administrative interface is only accessible from a trusted internal management network.

Public Exploit Available: Yes, a functional proof-of-concept is documented in the technical write-up provided by the researcher on GitHub.

This vulnerability is critical due to its potential for unauthenticated remote code execution and the availability of public exploit material. IT administrators must prioritize isolating affected routers from external exposure immediately. Given the lack of a clear public patch, users should consider replacing the hardware if the vendor does not provide an urgent firmware update.