A3002r Firmware CVE-2025-6164

High real-world priority based on convergence of multiple risk signals: (1) CVSS 8.8 reflects remote network attack vector (AV:N) with low complexity (AC:L), but requires low privileges (PR:L)—a significant constraint reducing opportunistic risk; (2) Public POC availability accelerates weaponization timeline; (3) The vulnerability requires authentication, which eliminates completely unauthenticated attack chains but remains serious for compromised user accounts or weak default credentials common in IoT; (4) Embedded router context creates persistent threat—infected devices participate in botnets and lateral network attacks; (5) No KEV/CISA status confirmation in provided data limits government prioritization signal. SSVC framework assessment: Exploitation status = PUBLIC (POC disclosed), Automatable = HIGH (buffer overflow patterns), Technical Impact = COMPLETE (RCE achieves all three C/I/A). The PR:L requirement downgrades from maximum severity but does not eliminate urgency for multi-tenant or ISP-managed deployments where attackers may have legitimate low-privilege access.

An attacker with low-privilege access to the router's web management interface (obtained via credential stuffing against default passwords, social engineering, or as a legitimate household user) crafts an HTTP POST request to /boafrm/formMultiAP with an oversized 'submit-url' parameter containing shellcode. The unvalidated input overflows the stack buffer, overwriting the return address with a pointer to attacker-controlled code. Upon function return, the processor executes injected instructions with the privileges of the web server process (typically root in embedded systems). The attacker gains remote code execution, enabling installation of persistent backdoors, credential theft, botnet enrollment, or lateral movement into the home/corporate network. With public POC available, automation is trivial—scanning for vulnerable router models and executing canned exploits against known weak credentials is within reach of commodity botnet operators.