A3002r Firmware CVE-2025-6487

CVSS 8.8 (High/Critical) reflects the severity: network-accessible (AV:N), low attack complexity (AC:L), but requires low-privilege authentication (PR:L), resulting in high impact across all three pillars (C:H/I:H/A:H). The disclosure of proof-of-concept code significantly elevates real-world risk despite the PR:L requirement—authenticated users (guests, family members with WiFi access, or compromised low-privilege accounts) can trigger remote code execution. The public POC availability combined with the straightforward nature of stack overflows makes automation feasible (SSVC: exploitation likely, automatable). This is NOT a low-real-risk issue: it represents an immediate threat to home network security, critical infrastructure using TOTOLINK equipment, and enterprise networks with BYOD policies. The primary limiting factor is the PR:L requirement, which reduces attack surface compared to unauthenticated RCE but does not significantly lower risk in typical deployment scenarios where WiFi guests or local network access is common.

A user connects to a TOTOLINK A3002R WiFi network and authenticates (satisfying PR:L requirement). The attacker crafts an HTTP POST request to /boafrm/formRoute with an oversized subnet parameter (e.g., crafted payload >buffer size). The web server processes the request with root privileges, and the unvalidated subnet value overflows the stack buffer in the formRoute function. The attacker's shellcode overwrites the return pointer on the stack. Upon function return, execution jumps to attacker-controlled code, granting remote code execution with root privileges. The attacker can then: establish persistent backdoor, pivot to other network devices, exfiltrate network traffic, or launch attacks against other hosts on the network. With public POC code available, this can be automated into an exploitation tool targeting unpatched devices on accessible networks.