EUVD-2026-77140
GHSA-8jwp-4qfm-p6r2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable boa interface requires low-privilege auth (PR:L); router compromise yields scope change affecting all downstream LAN clients (S:C).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
Buffer overflow in the Totolink A3002MU router's boa web server allows network-adjacent authenticated attackers to potentially execute arbitrary code by sending a crafted request with an oversized ip6addr argument to the /boafrm/formFilter endpoint. The affected firmware version is Hh-B20211125.1046, and a public proof-of-concept exploit has been published on GitHub. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) authenticated access to the Totolink A3002MU's boa web management interface - at minimum low-privilege credentials (PR:L per CVSS 4.0 vector); (2) the target must be running firmware version Hh-B20211125.1046 (no other confirmed affected versions identified); (3) the formFilter endpoint (/boafrm/formFilter) must be reachable, which is true by default on the LAN-side interface and potentially on the WAN side if remote management is enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects a high-severity but authenticated attack - PR:L indicates at least basic credentials are required to reach the vulnerable endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; no fixed firmware version is referenced in any available source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit your network inventory for Totolik A3002MU routers running firmware version Hh-B20211125.1046; review administrative access logs for the /boafrm/formFilter endpoint; and restrict web administration access to trusted IP addresses only via firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today