A critical command injection vulnerability in the Totolink A3002MU router allows remote attackers to achieve full system compromise via the formWsc interface.

The vulnerability is a command injection flaw (CWE-77) located in the /boafrm/formWsc endpoint. By manipulating the localPin parameter in a POST request, an authenticated attacker can inject shell metacharacters that are executed by the underlying system with root privileges.

Successful exploitation of this vulnerability grants an attacker complete control over the affected router. This allows for unauthorized network access, data interception, or the use of the device as a pivot point to attack other internal assets. Given the CVSS score of 9.9, this vulnerability represents an extreme risk to infrastructure integrity and confidentiality.

Immediate Action: There is currently no official patch available from the vendor. Users should restrict access to the router management interface to trusted internal networks only and disable remote management features immediately.

Proactive Monitoring: Security teams should monitor network traffic for suspicious POST requests targeting the /boafrm/formWsc endpoint, particularly those containing shell syntax or unexpected characters in the localPin parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-based Intrusion Prevention System (IPS) to filter and block requests containing malicious command injection payloads directed at the router interface.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up by the vulnerability reporter on GitHub.

This vulnerability presents a critical security risk due to the potential for full device takeover. Because no vendor patch is currently available, network administrators must prioritize isolating the affected hardware from external exposure and implementing strict access controls to prevent unauthorized interaction with the vulnerable management interface.