Description

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-14T00:16:57.447Z",
  "pubdate": "2026-09-14T00:16:57.447Z",
  "executiveSummary": "A critical buffer overflow vulnerability has been identified in the Totolink A3002MU (version Hh-B20211125.1046) within the boa web server component.\nThe vulnerability originates in the formFilter function, which fails to properly validate the length of the input supplied to the ip6addr argument.\nThis flaw allows a remote, unauthenticated attacker to inject malicious data, potentially leading to memory corruption, remote code execution, or device instability.\nGiven that public exploit code is available, the risk to affected devices is considered high, as the vulnerability can be triggered via network-accessible interfaces without requiring prior authentication.\nSuccessful exploitation compromises the integrity and availability of the affected Totolink hardware.",
  "technicalDetails": "The vulnerability resides in the formFilter function located within the boa web server implementation used by the Totolink A3002MU, specifically accessible via the /boafrm/formFilter endpoint.\nThe root cause is an improper bounds check (buffer overflow) when processing the ip6addr argument sent during an HTTP request.\nThe application allocates a fixed-size buffer on the stack to store the user-supplied ip6addr parameter. However, the function does not implement adequate length verification before copying the input into this destination buffer.\nBy supplying an overly long string as the ip6addr argument, an attacker can overwrite adjacent memory segments on the stack, including the return address of the function.\nThe attack flow involves an attacker crafting a malicious HTTP POST request targeting the /boafrm/formFilter path. The payload includes an ip6addr parameter containing a string designed to exceed the allocated stack buffer size.\nUpon processing this request, the web server writes the excessive input past the intended buffer boundary, corrupting the execution flow. If the attacker crafts the overflow payload to include malicious machine code (shellcode) and overwrites the function's return address to point toward this code, they can achieve arbitrary remote code execution.\nThe vulnerability is remotely exploitable over the network, requiring no authentication or specific user interaction, making it highly accessible for automated attack tools.\nThe impact of a successful exploitation includes a crash of the boa web server (Denial of Service) or complete system takeover if the attacker successfully directs execution to their payload.\nGiven that the exploit is publicly available, threat actors may leverage this vulnerability to gain unauthorized control over the device, potentially using it as a foothold for further network compromise."
}