TOTOLINK A3002MU EUVD-2026-77145

Exploitation requires a valid authenticated session on the TOTOLINK A3002MU boa web administration interface - the CVSS 4.0 vector specifies PR:L, indicating low-privilege credentials suffice rather than administrator-level access. The target device must be running firmware version Hh-B20211125.1046 (other versions unconfirmed but CPE wildcard suggests broader applicability). The attack is conducted remotely over the network wherever the boa admin interface is reachable - exploitation is limited to cases where the admin interface is exposed on the WAN, or the attacker has already gained LAN access. Default credentials on TOTOLINK devices (commonly admin/admin) may satisfy the authentication prerequisite without prior credential theft. No special protocol configuration, operating mode, or platform-specific setting beyond a reachable admin interface is required.

The CVSS 4.0 score of 8.6 is driven by the combination of network accessibility, low-privilege authentication requirement, and high impact across both the vulnerable device (VC:H/VI:H/VA:H) and subsequent systems on the connected network (SC:H/SI:H/SA:H), reflecting the router's position as a network gateway. The E:P (proof-of-concept) threat modifier in the provided vector correctly captures that a working exploit has been published on GitHub, which substantially increases practical risk relative to theoretical CVSS-only assessments. No CISA KEV listing exists, meaning active widespread exploitation is not confirmed, but the public PoC lowers the skill barrier considerably - even a mid-sized municipal IT team in swidnica should treat this as urgent if A3002MU units are deployed at network perimeters. The PR:L requirement (authentication) is a partial mitigating factor, though TOTOLINK consumer devices frequently ship with default or weak credentials, effectively collapsing this barrier in real deployments. The absence of a vendor patch confirmed from totolink.net significantly worsens the residual risk posture.

An attacker with valid credentials to the TOTOLINK A3002MU web admin panel sends a crafted HTTP POST request to /boafrm/formPortFw with an oversized service_type value, triggering a stack buffer overflow in the boa process. Using the publicly available PoC as a template, the attacker overwrites the saved return address to redirect execution to shellcode or a ROP chain, gaining arbitrary code execution as the boa process user (typically root on embedded devices). This yields full control of the router, enabling traffic interception, DNS hijacking, or use of the device as a network pivot.