Description

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static_ipv6 leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-14T00:16:57.617Z",
  "pubdate": "2026-09-14T00:16:57.617Z",
  "executiveSummary": "A buffer overflow vulnerability exists in the Totolink A3002MU router, specifically within the formIpv6Setup function of the boa component.\nThe vulnerability is triggered by the improper handling of user-supplied input provided to the static_ipv6 argument within the /boafrm/formIpv6Setup endpoint.\nThis flaw allows a remote, unauthenticated attacker to inject malicious data that exceeds the allocated memory buffer, potentially leading to arbitrary code execution or a denial-of-service condition.\nBecause the boa component is a web server component often running with elevated privileges, successful exploitation could lead to full device compromise.\nGiven that the exploit has been disclosed publicly, the risk to affected devices is critical, particularly those exposed to the public internet.\nNo authentication is required to interact with the vulnerable endpoint, significantly increasing the attack surface and the probability of exploitation.",
  "technicalDetails": "The vulnerability resides in the function formIpv6Setup located within the /boafrm/formIpv6Setup file, which is part of the boa web server component used by Totolink A3002MU (version Hh-B20211125.1046).\nThe root cause is a classic stack-based buffer overflow resulting from an insecure implementation of data handling for the static_ipv6 input parameter. The application fails to perform adequate boundary checking when copying the user-provided string from the HTTP request into a fixed-size stack buffer.\nDuring the execution of formIpv6Setup, the application processes the static_ipv6 argument by copying the input data into a memory buffer. If the input exceeds the buffer's capacity, the excess data overwrites adjacent memory addresses on the stack.\nThe attack flow begins when an attacker crafts a malicious HTTP POST or GET request targeting the /boafrm/formIpv6Setup URI. The request includes the static_ipv6 parameter populated with a crafted payload containing a specific sequence of characters designed to overflow the buffer and overwrite the function's return address.\nBy controlling the return address, an attacker can hijack the instruction pointer (EIP/RIP) to redirect execution flow toward attacker-controlled shellcode injected as part of the payload or toward existing code in the process space (Return-Oriented Programming).\nBecause the boa web server typically runs with root or high-level system privileges on these embedded devices, achieving arbitrary code execution grants the attacker complete control over the router's operating system, network traffic, and connected clients.\nThe vulnerability is remotely exploitable, meaning the attacker does not require physical access to the device or pre-existing authentication credentials. The network exposure is high if the web administration interface is accessible from the WAN interface.\nThe post-exploitation impact includes the potential for persistent device compromise, installation of backdoors, pivoting into the local network, or performing man-in-the-middle attacks on the device's traffic."
}