Description

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-14T01:16:27.870Z",
  "pubdate": "2026-09-14T01:16:27.870Z",
  "executiveSummary": "A buffer overflow vulnerability exists within the Totolink A3002MU firmware (version Hh-B20211125.1046) specifically affecting the boa web server component.\nThe vulnerability originates in the formNewSchedule function located in the /boafrm/formNewSchedule file, triggered by insecure handling of the submit-url argument.\nSuccessful exploitation allows a remote, unauthenticated attacker to inject malicious data, leading to a buffer overflow condition.\nThe primary risk implications include potential arbitrary code execution, denial of service (system crashes), and compromise of the device's integrity.\nGiven that the exploit is publicly available, the risk of exploitation by malicious actors is significant for devices directly exposed to the internet.\nThe vulnerability requires no prior authentication, significantly lowering the barrier for entry for remote attackers.",
  "technicalDetails": "The vulnerability resides within the boa web server component of the Totolink A3002MU firmware, specifically targeting the formNewSchedule function. The function fails to perform adequate boundary checking when parsing the submit-url input parameter provided in the HTTP request.\nDuring execution, the function copies the user-supplied data from the submit-url argument into a fixed-size stack-based buffer. Because the application logic does not validate the length of this input prior to the copy operation, an attacker can supply an input string exceeding the allocated buffer capacity.\nThis mismatch between the length of the input data and the destination buffer triggers a memory corruption event, specifically a stack-based buffer overflow. By carefully crafting the malicious payload, an attacker can overwrite adjacent memory, including the saved frame pointer and the return address on the stack.\nThe attack flow follows a predictable sequence: First, the attacker sends a specially crafted HTTP request to the /boafrm/formNewSchedule endpoint. This request includes a maliciously long string within the submit-url field. Upon receiving the request, the boa web server passes this input to the vulnerable function, which performs the insecure copy. The resulting overflow allows the attacker to hijack the instruction pointer (EIP/RIP) when the function attempts to return, redirecting execution to attacker-controlled shellcode or triggering a Return-Oriented Programming (ROP) chain.\nThe component /boafrm/formNewSchedule is exposed through the device's web interface. Because the vulnerability is reachable from a remote network environment, it does not require local access or administrative privileges. Post-exploitation, an attacker gains the ability to execute arbitrary commands with the privileges of the web server process, which frequently runs with elevated permissions on embedded devices. This facilitates full device compromise, allowing the attacker to establish persistence, exfiltrate configuration data, or leverage the device as a node in a broader malicious network."
}