N302r Plus Firmware EUVD-2025-17013

This vulnerability presents HIGH REAL-WORLD RISK despite being older (firmware version from 2020). Risk factors: (1) CVSS 8.8 with AV:N (network-accessible), AC:L (low complexity), PR:L (requires low privilege - authenticated user), indicating relatively easy remote exploitation; (2) Public exploit disclosure significantly elevates practical risk; (3) CWE-119 buffer overflows are historically one of the most reliably exploitable vulnerability classes; (4) The endpoint is accessible via standard HTTP POST without complex preconditions; (5) This is a consumer-grade router still actively deployed in networks (N302R Plus has long product lifecycle); (6) Authentication requirement (PR:L) moderately reduces risk but is not a strong control on home routers where users may share credentials or be socially engineered. SSVC assessment: Exploitation = Proven (POC disclosed), Automatable = Yes (straightforward POST request manipulation), Technical Impact = Total (RCE), therefore PRIORITY = CRITICAL. EPSS would likely be elevated due to public POC availability and proven exploitation path.

An authenticated attacker (or a user with valid router credentials obtained through phishing or credential stuffing) sends a specially crafted HTTP POST request to http://[router-ip]/boafrm/formPortFw with an oversized 'service_type' parameter value exceeding the destination buffer size. The value could be a long string (e.g., 2000+ bytes) designed to overwrite adjacent stack memory. Due to lack of bounds checking in the vulnerable firmware code, this overwrites the function's return address on the stack. By carefully crafting the payload, the attacker can redirect execution to injected shellcode, achieving remote code execution with the privileges of the web server process (typically root or similar high-privileged user on embedded Linux routers). This allows complete compromise: data exfiltration, botnet recruitment, lateral network movement, or persistent backdoor installation. Public POC likely provides step-by-step instructions or automated tooling to generate the malicious payload, lowering the barrier to exploitation significantly. Attack can be launched with simple curl/Python requests, no special network position required.