A3002Mu
Monthly
Stack-based buffer overflow in the TOTOLINK A3002MU router's QoS Rule Handler allows remote attackers to corrupt memory on the device by supplying oversized addQos, comment, or entry_name arguments to /boafrm/formIpQoS, with high confidentiality, integrity, and availability impact. Only firmware 1.0.0-B20230403.1455 is identified as affected, and publicly available exploit code exists (a published proof-of-concept gist), so anyone who can reach the management interface can attempt it. The published CVSS 4.0 vector scores 9.3 as network-reachable, low-complexity, and unauthenticated (PR:N/UI:N); note however that TOTOLINK /boafrm/ handlers commonly require an authenticated web session, so the realistic risk is concentrated where the admin interface is exposed to the WAN or reachable from an untrusted LAN segment.
Improper authorization in the boa web server on TOTOLINK A3002MU firmware 1.0.0-B20230403.1455 lets remote, unauthenticated attackers reach protected administrative functionality without a valid session, giving them full control over the device's web management interface (high confidentiality, integrity and availability impact). Publicly available exploit code exists against the authentication-check function sub_40FCFC in /bin/boa, so weaponisation effort is low, although no CISA KEV listing or other confirmation of active exploitation was present in the available intelligence at time of analysis. Exposure is the practical limiter: units with WAN-side management enabled are directly internet-exploitable, whereas units whose admin interface is LAN-only require an on-network attacker or a LAN-side pivot.
OS command injection in the Totolink A3002MU router firmware (build Hh-B20211125.1046) lets a remote attacker who holds valid low-privilege credentials execute arbitrary shell commands on the device through the formWsc handler in /boafrm/formWsc by supplying a crafted localPin argument. Because the affected component is the router's BOA web management service, successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 4.0 score 8.6, PR:L, no user interaction), and on consumer routers the required low-privilege session is often trivially satisfied by unchanged default administrative credentials. Publicly available exploit code exists (a published proof-of-concept walkthrough for the A3002MU rce-formWsc path), and although there is no confirmation of active exploitation in CISA KEV, the combination of a public PoC, a network-reachable attack surface and low complexity makes this a high-priority patching target for internet- or LAN-exposed devices.
A stack-based buffer overflow in the TOTOLINK A3002MU wireless router (firmware Hh-B20211125.1046) allows remote attackers to corrupt memory through the 'submit-url' argument handled by the formWlWds function at /boafrm/formWlWds, with the CVSS 4.0 vector scoring 9.3 and indicating no authentication or user interaction prerequisite (PR:N/UI:N), though the independent assessment notes the endpoint's pre-authentication status is not explicitly confirmed by the description. Impact is potentially full compromise of confidentiality, integrity, and availability on the device, but practical success depends on network reachability to the Boa web management interface, the specific firmware build, and the difficulty of converting an embedded-MIPS stack overflow into reliable code execution rather than a simple crash. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Buffer overflow in the TOTOLINK A3002MU router (firmware Hh-B20211125.1046) lets remote attackers corrupt memory by sending a crafted submit-url value to the /boafrm/formWlEncrypt endpoint, with the vendor's CVSS 4.0 vector rated 9.3 and full confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The CVSS 4.0 vector specifies PR:N and UI:N, meaning the attack is unauthenticated and requires no user interaction, and publicly available exploit code exists, though no confirmed active exploitation has been reported (no CISA KEV listing). The dominant practical gating factor is exposure of the device's boa-based HTTP management interface, which on most SOHO deployments is reachable only from the LAN, narrowing the threat to local or adjacent-network attackers unless remote administration is enabled.
A buffer overflow in TOTOLINK A3002MU routers running firmware Hh-B20211125.1046 lets an authenticated remote attacker corrupt memory by sending an oversized submit-url value to the formWlAc handler at /boafrm/formWlAc, potentially gaining full control over the device's confidentiality, integrity and availability. Publicly available exploit code exists - a proof-of-concept write-up is published on GitHub and the flaw is documented by VulDB - but there is no evidence of confirmed active exploitation (CISA KEV). Multiple signals align to a moderate-to-high real-world risk, with the practical prerequisite being valid credentials or an active admin session and a management interface reachable from the attacker's network.
Authenticated buffer overflow in the web management interface of the TOTOLINK A3002MU router (firmware build Hh-B20211125.1046) lets an attacker who already holds a valid management session corrupt memory via an oversized 'webpage' argument submitted to /boafrm/formSchedule, with the potential for code execution and full loss of confidentiality, integrity, and availability. The reporting source rates it 8.6 (CVSS 4.0), and publicly available exploit code exists, but there is no confirmed active exploitation and the flaw is not in CISA KEV. In practice this is a genuine but moderate-priority issue: the CVSS vector's PR:L and the device's normally LAN-only management plane mean the attacker needs authenticated access reachable to the router's admin interface, so risk rises sharply only where remote/WAN administration or default credentials are exposed.
Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis.
Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis.
Stack-based buffer overflow in Totolink A3002MU router firmware B20211125.1046 allows authenticated remote attackers to execute arbitrary code via crafted 'wan-url' parameter in /boafrm/formWlanSetup endpoint. Publicly available exploit code exists (PoC on GitHub). EPSS score of 0.08% (23rd percentile) indicates low observed exploitation probability despite public exploit, likely due to authentication requirement (PR:L) and narrow attack surface of legacy consumer router product.
Path traversal in the Totolink A3002MU router's File Upload Handler (firmware 1.0.0-B20230403.1455) allows remote unauthenticated attackers to write files outside the intended upload directory by manipulating the 'filename' argument to /boafrm/formUploadFile. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV). The CVSS 4.0 score is 5.3 with low confidentiality, integrity, and availability impact, and the vector requires passive user interaction (UI:P), so exploitation is not fully unattended. Realistic risk depends on whether the upload interface is reachable from untrusted networks.
Cross-site scripting in the Anchor Tag Handler of Totolink A3002MU firmware version Hh-B20211125.1046 allows network-accessible attackers with low-privilege credentials to inject malicious scripts into the router's web management interface, which execute in a victim's browser upon interaction. A public proof-of-concept exploit has been published on GitHub, lowering the technical barrier for exploitation. No vendor-released patch has been identified in the available intelligence, and the firmware timestamp (November 2021) suggests this is a long-unsupported build unlikely to receive a security update.
Stack-based buffer overflow in the TOTOLINK A3002MU router's QoS Rule Handler allows remote attackers to corrupt memory on the device by supplying oversized addQos, comment, or entry_name arguments to /boafrm/formIpQoS, with high confidentiality, integrity, and availability impact. Only firmware 1.0.0-B20230403.1455 is identified as affected, and publicly available exploit code exists (a published proof-of-concept gist), so anyone who can reach the management interface can attempt it. The published CVSS 4.0 vector scores 9.3 as network-reachable, low-complexity, and unauthenticated (PR:N/UI:N); note however that TOTOLINK /boafrm/ handlers commonly require an authenticated web session, so the realistic risk is concentrated where the admin interface is exposed to the WAN or reachable from an untrusted LAN segment.
Improper authorization in the boa web server on TOTOLINK A3002MU firmware 1.0.0-B20230403.1455 lets remote, unauthenticated attackers reach protected administrative functionality without a valid session, giving them full control over the device's web management interface (high confidentiality, integrity and availability impact). Publicly available exploit code exists against the authentication-check function sub_40FCFC in /bin/boa, so weaponisation effort is low, although no CISA KEV listing or other confirmation of active exploitation was present in the available intelligence at time of analysis. Exposure is the practical limiter: units with WAN-side management enabled are directly internet-exploitable, whereas units whose admin interface is LAN-only require an on-network attacker or a LAN-side pivot.
OS command injection in the Totolink A3002MU router firmware (build Hh-B20211125.1046) lets a remote attacker who holds valid low-privilege credentials execute arbitrary shell commands on the device through the formWsc handler in /boafrm/formWsc by supplying a crafted localPin argument. Because the affected component is the router's BOA web management service, successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 4.0 score 8.6, PR:L, no user interaction), and on consumer routers the required low-privilege session is often trivially satisfied by unchanged default administrative credentials. Publicly available exploit code exists (a published proof-of-concept walkthrough for the A3002MU rce-formWsc path), and although there is no confirmation of active exploitation in CISA KEV, the combination of a public PoC, a network-reachable attack surface and low complexity makes this a high-priority patching target for internet- or LAN-exposed devices.
A stack-based buffer overflow in the TOTOLINK A3002MU wireless router (firmware Hh-B20211125.1046) allows remote attackers to corrupt memory through the 'submit-url' argument handled by the formWlWds function at /boafrm/formWlWds, with the CVSS 4.0 vector scoring 9.3 and indicating no authentication or user interaction prerequisite (PR:N/UI:N), though the independent assessment notes the endpoint's pre-authentication status is not explicitly confirmed by the description. Impact is potentially full compromise of confidentiality, integrity, and availability on the device, but practical success depends on network reachability to the Boa web management interface, the specific firmware build, and the difficulty of converting an embedded-MIPS stack overflow into reliable code execution rather than a simple crash. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Buffer overflow in the TOTOLINK A3002MU router (firmware Hh-B20211125.1046) lets remote attackers corrupt memory by sending a crafted submit-url value to the /boafrm/formWlEncrypt endpoint, with the vendor's CVSS 4.0 vector rated 9.3 and full confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The CVSS 4.0 vector specifies PR:N and UI:N, meaning the attack is unauthenticated and requires no user interaction, and publicly available exploit code exists, though no confirmed active exploitation has been reported (no CISA KEV listing). The dominant practical gating factor is exposure of the device's boa-based HTTP management interface, which on most SOHO deployments is reachable only from the LAN, narrowing the threat to local or adjacent-network attackers unless remote administration is enabled.
A buffer overflow in TOTOLINK A3002MU routers running firmware Hh-B20211125.1046 lets an authenticated remote attacker corrupt memory by sending an oversized submit-url value to the formWlAc handler at /boafrm/formWlAc, potentially gaining full control over the device's confidentiality, integrity and availability. Publicly available exploit code exists - a proof-of-concept write-up is published on GitHub and the flaw is documented by VulDB - but there is no evidence of confirmed active exploitation (CISA KEV). Multiple signals align to a moderate-to-high real-world risk, with the practical prerequisite being valid credentials or an active admin session and a management interface reachable from the attacker's network.
Authenticated buffer overflow in the web management interface of the TOTOLINK A3002MU router (firmware build Hh-B20211125.1046) lets an attacker who already holds a valid management session corrupt memory via an oversized 'webpage' argument submitted to /boafrm/formSchedule, with the potential for code execution and full loss of confidentiality, integrity, and availability. The reporting source rates it 8.6 (CVSS 4.0), and publicly available exploit code exists, but there is no confirmed active exploitation and the flaw is not in CISA KEV. In practice this is a genuine but moderate-priority issue: the CVSS vector's PR:L and the device's normally LAN-only management plane mean the attacker needs authenticated access reachable to the router's admin interface, so risk rises sharply only where remote/WAN administration or default credentials are exposed.
Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis.
Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis.
Stack-based buffer overflow in Totolink A3002MU router firmware B20211125.1046 allows authenticated remote attackers to execute arbitrary code via crafted 'wan-url' parameter in /boafrm/formWlanSetup endpoint. Publicly available exploit code exists (PoC on GitHub). EPSS score of 0.08% (23rd percentile) indicates low observed exploitation probability despite public exploit, likely due to authentication requirement (PR:L) and narrow attack surface of legacy consumer router product.
Path traversal in the Totolink A3002MU router's File Upload Handler (firmware 1.0.0-B20230403.1455) allows remote unauthenticated attackers to write files outside the intended upload directory by manipulating the 'filename' argument to /boafrm/formUploadFile. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV). The CVSS 4.0 score is 5.3 with low confidentiality, integrity, and availability impact, and the vector requires passive user interaction (UI:P), so exploitation is not fully unattended. Realistic risk depends on whether the upload interface is reachable from untrusted networks.
Cross-site scripting in the Anchor Tag Handler of Totolink A3002MU firmware version Hh-B20211125.1046 allows network-accessible attackers with low-privilege credentials to inject malicious scripts into the router's web management interface, which execute in a victim's browser upon interaction. A public proof-of-concept exploit has been published on GitHub, lowering the technical barrier for exploitation. No vendor-released patch has been identified in the available intelligence, and the firmware timestamp (November 2021) suggests this is a long-unsupported build unlikely to receive a security update.