A3002r Firmware CVE-2025-6149

This vulnerability presents substantial real-world risk across multiple dimensions: (1) CVSS 8.8 with network-accessible attack vector (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L) indicates broad exploitability; (2) the vulnerability requires only valid HTTP authentication but no special conditions; (3) confirmed public exploit availability significantly elevates practical exploitation likelihood; (4) buffer overflow vulnerabilities typically enable arbitrary code execution, justifying the HIGH impact ratings across confidentiality, integrity, and availability; (5) the router form factor means affected devices are often internet-facing and critical network infrastructure; (6) lack of patching information suggests unmaintained firmware poses indefinite risk. This is not a theoretical high-CVSS issue—it represents a genuine, actively exploitable critical flaw in production devices with real attack surface exposure.

An attacker with valid credentials to the router's web management interface (obtained through phishing, credential stuffing, or default credentials) sends a specially crafted HTTP POST request to /boafrm/formSysLog with an oversized or malformed 'submit-url' parameter containing shellcode. The vulnerable parameter handler fails to properly validate the input length before copying it to a fixed-size stack buffer, causing a buffer overflow. The attacker overwrites return addresses or function pointers on the stack, redirecting execution to injected shellcode that runs with root privileges on the router. This grants the attacker complete control of the device, enabling DNS hijacking, traffic interception, botnet recruitment, or lateral network movement. Given the public POC availability, script-kiddie level attackers can execute this attack with minimal sophistication. Attack complexity is low—no special conditions or user interaction required beyond initial compromise of valid credentials.