A3002ru Firmware CVE-2025-6148

This vulnerability presents exceptional real-world risk despite requiring authenticated access (PR:L in CVSS vector). Risk signals include: (1) CVSS 8.8 with network-accessible attack vector (AV:N) and low complexity (AC:L) indicating ease of exploitation; (2) public POC availability increases exploitation probability significantly; (3) buffer overflow vulnerabilities are historically highly automatable and reliable for RCE; (4) the requirement for low privileges (authenticated user) is not a significant barrier in many home/SMB deployments where default credentials persist or guest accounts exist; (5) SSVC analysis suggests EXPLOITATION:POC-EXISTS, AUTOMATABLE:YES, TECHNICAL-IMPACT:TOTAL-LOSS, making this a critical priority. The combination of disclosed exploits, RCE capability, and network reachability creates immediate operational risk. This is not a false-high-CVSS case; this is a genuinely exploitable and dangerous vulnerability.

An attacker with network access to the TOTOLINK A3002RU (typically on the same LAN or via exposed WAN management interface) authenticates with low-privilege credentials (e.g., guest account or obtained credentials) via HTTP POST to /boafrm/formSysLog. The attacker crafts a malicious submit-url parameter containing a carefully sized buffer overflow payload designed to overwrite return addresses or function pointers. Upon form processing, the oversized input overflows the buffer, allowing the attacker to execute arbitrary code with device privileges. With public POC available, this attack is highly reliable and can be automated. Impact includes full device compromise, potential lateral network movement, persistent backdoor installation, or use as a botnet node. Realistic attack timeline: reconnaissance (identify exposed A3002RU on network) → credential acquisition (default/weak credentials, information disclosure) → POC deployment → RCE → post-exploitation.