EUVD-2025-18457CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in TOTOLINK A702R router firmware (version 4.0.0-B20230721.1521) affecting the HTTP POST request handler for the /boafrm/formSysLog endpoint. An authenticated attacker can exploit this vulnerability remotely by manipulating the submit-url parameter to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code is available, significantly elevating real-world exploitation risk.
Technical Context
The vulnerability exists in the HTTP POST request handler component of the TOTOLINK A702R router's web interface, specifically within the /boafrm/formSysLog endpoint. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where user-supplied input to the submit-url parameter is not properly validated or bounds-checked before being copied into a fixed-size buffer. This occurs during parsing of formSysLog form submissions. TOTOLINK A702R is an entry-level 802.11n wireless router commonly deployed in small office/home office (SOHO) environments. The affected firmware version 4.0.0-B20230721.1521 indicates a build from July 2023. The vulnerability allows an authenticated user with valid credentials to the router's administrative interface to overflow the buffer and execute arbitrary code in the context of the router's HTTP daemon process.
Affected Products
TOTOLINK A702R firmware version 4.0.0-B20230721.1521 and potentially earlier versions with the same vulnerable code path. CPE representation: cpe:2.3:o:totolink:a702r_firmware:4.0.0-b20230721.1521:*:*:*:*:*:*:*. Affected hardware: TOTOLINK A702R wireless router (specific model). The vulnerability likely affects other TOTOLINK router models using similar firmware branches, though only A702R has been formally confirmed. No patch version information is provided in available references; users should check TOTOLINK's official support pages for firmware updates newer than the July 2023 build.
Remediation
Immediate actions: (1) Check TOTOLINK's official website (https://www.totolink.net/) for firmware updates released after 4.0.0-B20230721.1521; (2) If a patched firmware version is available, download and apply it following the vendor's update procedure (typically via the router's web interface or via TFTP); (3) If no patch is available, implement compensating controls: restrict HTTP access to the /boafrm/formSysLog endpoint via firewall rules, disable remote management/WAN access to the router's web interface, and enforce strong administrator credentials; (4) Monitor router logs for POST requests to /boafrm/formSysLog with suspicious submit-url parameter values; (5) Consider replacing the affected device if the vendor does not provide timely security updates, particularly in production environments. Contact TOTOLINK support at [email protected] or via their website for vendor advisory and patch availability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today