N302r Plus Firmware CVE-2025-5672

Despite the CVSS 3.1 score of 8.8 (high), multiple factors elevate real-world risk to CRITICAL: (1) CVSS vector AV:N/AC:L indicates network-accessible exploitation with low complexity; (2) PR:L (low privilege required) means even non-admin authenticated users can exploit; (3) Public POC availability significantly increases likelihood of widespread exploitation; (4) The vulnerability affects consumer-grade networking equipment with potentially millions of deployments; (5) Buffer overflow vulnerabilities frequently enable remote code execution and complete system compromise beyond the stated CIA impact. SSVC analysis: Exploitation=Active (public POC), Automatable=Yes (programmatic buffer manipulation), Technical Impact=Total (code execution likely). Real-world risk substantially exceeds the numerical CVSS rating due to widespread deployment, public exploits, and infrastructure criticality of router devices.

An attacker on the same network or with network access to a TOTOLINK N302R Plus router authenticates to the web administrative interface (low privilege user account or via credential compromise). The attacker crafts a malicious HTTP POST request to /boafrm/formFilter with an oversized or specially crafted 'url' parameter containing shellcode or ROP gadget chains. The lack of bounds checking causes the buffer overflow, overwriting adjacent memory including the stack return address. Depending on router architecture and firmware protections, this enables arbitrary code execution with router privilege level, allowing the attacker to: modify firewall rules, intercept network traffic, deploy persistent backdoors, or launch further attacks on connected devices. The public POC availability means this exploit is readily weaponizable and likely already integrated into automated attack frameworks targeting TOTOLINK devices.