A702r Firmware CVE-2025-6147

This vulnerability presents HIGH real-world risk despite requiring authenticated access (PR:L in CVSS vector). Risk signals indicate: (1) CVSS 8.8 (High severity) with network-accessible attack vector (AV:N) and low complexity (AC:L), indicating straightforward exploitation; (2) Public exploit disclosure eliminates the need for attacker reconnaissance or reverse-engineering; (3) Authentication requirement (PR:L) reduces immediate risk for unauthenticated internet-facing attacks but is a minimal barrier—router credentials are frequently weak, default, or leaked in SOHO environments; (4) Buffer overflow in memory-constrained embedded systems typically enables complete device compromise; (5) CWE-119 is a well-understood and reliably exploitable vulnerability class. Exploitation probability is HIGH. Real-world priority assessment: This is a legitimate high-priority issue, particularly for organizations managing TOTOLINK devices in production. The combination of public POC, network accessibility, and low complexity makes this an immediate threat to affected deployments. SOHO users and small businesses are particularly vulnerable due to typically weaker security practices and slower patching cycles.

An attacker with valid administrative credentials (obtained through credential stuffing, brute-force attack on weak passwords, or social engineering) authenticates to the TOTOLINK A702R web management interface. The attacker then submits a specially crafted HTTP POST request to /boafrm/formSysLog with a maliciously long submit-url parameter containing shellcode. The parameter value exceeds the buffer's bounds, overwriting adjacent memory including the stack frame's return address. The overflow redirects program execution to the attacker's injected shellcode, which runs with the privileges of the HTTP daemon process (typically root on embedded routers). The attacker gains shell access to the router and can: modify firewall rules, intercept network traffic, pivot to internal networks, deploy malware/botnets, exfiltrate data, or disable the device. Public POC code is available on security disclosure platforms, lowering the barrier to exploitation for less-skilled attackers.