EUVD-2025-18482Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in TOTOLINK A3002R 4.0.0-B20230531.1404. It has been classified as critical. This affects an unknown part of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical buffer overflow vulnerability in TOTOLINK A3002R router firmware version 4.0.0-B20230531.1404, affecting the HTTP POST request handler in the /boafrm/formMultiAP endpoint. An authenticated attacker can exploit improper input validation on the 'submit-url' parameter to achieve remote code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code is available, increasing real-world exploitation risk.
Technical ContextAI
The vulnerability exists in the HTTP POST request handler component of TOTOLINK's web-based management interface. The affected endpoint /boafrm/formMultiAP fails to properly validate or bound-check the 'submit-url' parameter before processing it, leading to a classic stack or heap-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). This is a common vulnerability class in embedded device firmware where legacy C code lacks modern memory safety protections. TOTOLINK A3002R is a residential WiFi router (CPE: cpe:2.7:a:totolink:a3002r:4.0.0:b20230531.1404:*:*:*:*:*:*) running embedded Linux with a web management interface. The lack of ASLR, stack canaries, or DEP protections typical in budget router firmware makes exploitation straightforward once buffer boundaries are identified.
RemediationAI
Immediate: (1) If TOTOLINK has issued a firmware patch, upgrade to the latest stable version (check support.totolink.net or regional support sites for build dates post-May 2023); (2) If no official patch exists, implement network-level mitigation: restrict access to router management interface (port 80/443) to trusted IP addresses only via firewall rules; (3) Disable remote management features if not required; (4) Change default credentials and enforce strong authentication. Short-term: Monitor TOTOLINK advisory channels for security bulletins. Long-term: Consider device replacement with vendors demonstrating active security patching practices. If source code or detailed advisory emerges, WAF rules blocking oversized or malformed 'submit-url' parameters may provide temporary boundary protection, though this is not a substitute for patching.
Share
External POC / Exploit Code
Leaving vuln.today