EUVD-2025-18854
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6486 is a critical stack-based buffer overflow vulnerability in TOTOLINK A3002R router firmware version 1.1.1-B20200824.0128, affecting the formWlanMultipleAP function. An authenticated remote attacker can exploit this via manipulation of the 'submit-url' parameter to achieve code execution with high impact on confidentiality, integrity, and availability. Public exploit code is available, increasing real-world exploitation risk.
Technical Context
This vulnerability exists in the web-based management interface of the TOTOLINK A3002R wireless router. The vulnerable endpoint is /boafrm/formWlanMultipleAP, which processes wireless LAN multiple access point configurations through the Boa web server. The vulnerability stems from a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) stack-based buffer overflow in the 'submit-url' parameter handling. The affected product is identified as TOTOLINK A3002R firmware version 1.1.1-B20200824.0128 (CPE: likely cpe:2.3:o:totolink:a3002r_firmware:1.1.1-b20200824.0128:*:*:*:*:*:*:*). The vulnerability indicates insufficient bounds checking when copying user-supplied input into fixed-size stack buffers, allowing attackers to overwrite the stack and potentially execute arbitrary code.
Affected Products
A3002R (['1.1.1-B20200824.0128'])
Remediation
Check TOTOLINK A3002R support/download page for firmware versions newer than 1.1.1-B20200824.0128. Apply available firmware updates immediately if accessible. Network Mitigation: Restrict access to the router management interface (/boafrm/*) to trusted networks only. Implement firewall rules to block external access to the router's web management port (default 80/443 or 8080). Authentication Hardening: Change default administrative credentials to strong, unique passwords. Consider disabling remote management features if not required. Monitoring: Monitor for suspicious POST requests to /boafrm/formWlanMultipleAP endpoint with unusual 'submit-url' parameter values. Enable logging on the router if available. Vendor Advisory: Consult TOTOLINK security advisories or contact vendor support at totolink.net for patch availability and upgrade paths.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today