A3002r Firmware CVE-2025-6486

The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates high severity: network-accessible, low attack complexity, but requires low privileges (authenticated user). The PR:L requirement significantly reduces opportunistic exploitation compared to unauthenticated vulnerabilities. However, the combination of public POC availability, confirmed exploit disclosure, and stack overflow nature (reliable code execution primitive) elevates real-world risk considerably. The lack of user interaction (UI:N) and unchanged security scope (S:U) confirm direct impact. Without explicit EPSS or KEV data provided, the public POC status and disclosed exploit nature suggest this is actively exploitable and should be treated as high priority, though not emergency-level due to authentication requirement. Organizations using affected firmware should prioritize patching based on network exposure of the management interface.

An attacker with valid credentials (or obtained through credential compromise, phishing, or default credentials) authenticates to the TOTOLINK A3002R web management interface. The attacker crafts a malicious POST request to /boafrm/formWlanMultipleAP with an oversized 'submit-url' parameter containing shellcode and ROP gadgets. The vulnerable function fails to properly validate input length, causing a stack buffer overflow that overwrites the return address. Control flow is hijacked to execute injected shellcode, potentially allowing the attacker to gain root-level command execution on the router. From this position, the attacker could reconfigure network settings, intercept traffic, establish persistence, or pivot to other network devices. Public POC availability means automated tools can be easily adapted for mass exploitation of vulnerable instances exposed to the internet or vulnerable to credential compromise.