EUVD-2026-77140
GHSA-8jwp-4qfm-p6r2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain router admin credentials (default or brute-forced)
-
DeliveryAuthenticate to boa web interface at /boafrm/formFilter
-
ExploitSubmit crafted POST request with oversized ip6addr parameter
-
InstallTrigger unbounded buffer copy in formFilter function
-
C2Overflow stack/heap buffer corrupting control data
-
ExecuteExecute arbitrary code as root on router
-
ImpactPivot into LAN or intercept traffic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) authenticated access to the Totolink A3002MU's boa web management interface - at minimum low-privilege credentials (PR:L per CVSS 4.0 vector); (2) the target must be running firmware version Hh-B20211125.1046 (no other confirmed affected versions identified); (3) the formFilter endpoint (/boafrm/formFilter) must be reachable, which is true by default on the LAN-side interface and potentially on the WAN side if remote management is enabled. Exploitation is limited by: the requirement for valid credentials (though default credentials substantially reduce this barrier on consumer devices), and the specific firmware version. No special non-default feature or protocol needs to be enabled beyond standard admin interface access. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects a high-severity but authenticated attack - PR:L indicates at least basic credentials are required to reach the vulnerable endpoint. The E:P modifier confirms a public POC exists, elevating practical risk. There is no CISA KEV listing, so confirmed active exploitation is not established. The subsequent-system impact metrics (SC:H/SI:H/SA:H) are well-justified: a compromised router sits on the network path for all connected clients, meaning device compromise implies traffic interception, DNS hijacking, and pivoting into the LAN. The key realistic risk limiter is PR:L - an attacker must have authenticated access to the router's admin panel. Default or unchanged credentials on consumer routers are common in practice, however, reducing this barrier significantly in real-world deployments. EPSS data is not provided in the input; given VulDB-reported, POC-available IoT CVEs of this class, exploitation probability against unpatched devices with default credentials is non-trivial. Overall: elevated practical priority for any Totolink A3002MU deployment, especially where admin credentials have not been changed from defaults. |
| Exploit ScenarioDerived | An attacker who has obtained valid credentials to the Totolink A3002MU admin panel - either through default credential use, credential theft, or brute force - sends a crafted HTTP POST request to /boafrm/formFilter with an ip6addr parameter containing a maliciously long string. The formFilter function copies the supplied value into a fixed-size buffer without bounds checking, overflowing into adjacent memory and overwriting control data such as a saved return address. Given that boa on embedded routers typically runs as root, successful exploitation results in arbitrary command execution at the highest privilege level on the device. A public POC on GitHub lowers the skill bar for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 14, 2026
Buffer overflow in the Totolink A3002MU router's boa web server allows network-adjacent authenticated attackers to potentially execute arbitrary code by sending a crafted request with an oversized ip6addr argument to the /boafrm/formFilter endpoint. The affected firmware version is Hh-B20211125.1046, and a public proof-of-concept exploit has been published on GitHub. No patch is available at time of analysis; the vulnerability carries a CVSS 4.0 score of 8.6 with subsequent-system impact metrics elevated due to the router's central network position.
RemediationAI
No vendor-released patch has been identified at time of analysis; no fixed firmware version is referenced in any available source. Immediately change the router's admin credentials from default values to prevent unauthenticated exploitation of the admin interface. Restrict access to the boa web management interface by disabling remote (WAN-side) web management if enabled - this reduces AV:N to a LAN-only attack surface without eliminating it. Where possible, isolate the router's management plane to a dedicated VLAN accessible only by trusted administrative hosts. Monitor the Totolink vendor advisory page (https://www.totolink.net/) for firmware updates. If the device cannot be patched, consider replacing it with a supported device, as this model's firmware date (November 2025) suggests the vendor may no longer be issuing routine security updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Totolink A3002MU is a consumer/SOHO dual-band router running the boa lightweight HTTP server - a common embedded web server in IoT and SOHO network devices. The vulnerable component is the formFilter CGI handler at /boafrm/formFilter, specifically the function that processes the ip6addr argument (an IPv6 address input field likely used for IP filtering rules). CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates the root cause is a classic unbounded copy or length-unchecked write when handling the ip6addr parameter, which allows a controlled overflow into adjacent stack or heap memory. On embedded Linux-based routers, the boa process typically runs with root or elevated privileges, making successful exploitation particularly impactful. The CPE would align with cpe:2.3:o:totolink:a3002mu_firmware:hh-b20211125.1046:*:*:*:*:*:*:*.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable boa interface requires low-privilege auth (PR:L); router compromise yields scope change affecting all downstream LAN clients (S:C).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Technical POC Analysis
Bug class as stated in the advisory: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), reported as a buffer overflow.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The Totolik A3002MU router (firmware Hh-B20211125.1046) contains a buffer overflow vulnerability in its web administration interface that allows network-adjacent authenticated users to potentially execute arbitrary code through a crafted request. With no vendor patch available and public exploit code already published, this poses significant risk to organizations relying on this model, as routers are critical network infrastructure through which all traffic flows.
No vendor-released patch identified at time of analysis. Publicly available exploit code exists, increasing risk of opportunistic exploitation. Interim mitigations include: restrict web administrative interface access via firewall ACLs to trusted management IPs only; disable HTTP/HTTPS administration if not actively required; implement network segmentation to limit lateral movement if router is compromised; deploy network-based intrusion detection to monitor for exploitation attempts on the /boafrm/formFilter endpoint; and maintain enhanced monitoring of router system logs for anomalous behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB