EUVD-2025-18456
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical remote buffer overflow vulnerability in TOTOLINK A3002RU firmware version 3.0.0-B20230809.1615 affecting the HTTP POST request handler for the /boafrm/formSysLog endpoint. An authenticated attacker can exploit this via manipulation of the submit-url parameter to achieve remote code execution with high confidentiality, integrity, and availability impact. The vulnerability has public exploit disclosure and represents an active threat to deployed devices.
Technical Context
The vulnerability exists in the HTTP POST request handler component of TOTOLINK A3002RU, specifically in the /boafrm/formSysLog file processing logic. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where user-supplied input via the submit-url parameter is not properly validated or bounds-checked before being written to a fixed-size buffer. The TOTOLINK A3002RU is a wireless router (CPE likely: cpe:2.3:h:totolink:a3002ru:3.0.0-*). The affected component processes form data in the boaform CGI interface, a common web-based management interface in embedded networking devices. The manipulation occurs at the HTTP application layer, with insufficient input sanitization allowing an attacker to overflow stack or heap buffers and inject arbitrary code.
Affected Products
TOTOLINK A3002RU (['3.0.0-B20230809.1615'])
Remediation
Immediate remediation steps: (1) If available, update TOTOLINK A3002RU firmware to a patched version released after 3.0.0-B20230809.1615 (check TOTOLINK support portal at support.totolink.net for firmware updates); (2) As an interim mitigation, restrict HTTP access to the /boafrm/formSysLog endpoint via firewall rules or network segmentation to trusted administrative networks only; (3) Disable or restrict access to the web-based management interface if not actively used; (4) Change default credentials and enforce strong authentication if the device supports it; (5) Monitor for suspicious POST requests to /boafrm/formSysLog with unusual submit-url parameter values. Vendor advisory and patches should be obtained directly from TOTOLINK; check for advisory notices on their security page or contact support for available firmware patches.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today