Description

A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument service_type causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-14T01:16:28.130Z",
  "pubdate": "2026-09-14T01:16:28.130Z",
  "executiveSummary": "The Totolink A3002MU (version Hh-B20211125.1046) contains a critical buffer overflow vulnerability within the boa web server component. The vulnerability resides in the formPortFw function, specifically triggered through improper handling of the service_type argument.\nThis flaw allows a remote, unauthenticated attacker to inject malicious data into the application's memory space, leading to a buffer overflow condition. Successful exploitation of this vulnerability can result in arbitrary code execution, system instability, or a complete denial-of-service state.\nGiven that the exploit is publicly available, the risk of active exploitation is high. Attackers can reach the vulnerable endpoint over the network without requiring prior authentication, making this an attractive target for remote adversaries seeking to compromise the router's operating environment.",
  "technicalDetails": "The vulnerability is located in the boa web server component of the Totolink A3002MU, specifically within the function formPortFw mapped to the URI /boafrm/formPortFw. The root cause of the vulnerability is a classic stack-based buffer overflow stemming from insufficient input validation and insecure memory management when processing the service_type HTTP POST argument.\nWhen a user submits a configuration request involving port forwarding settings, the formPortFw function parses the provided service_type parameter. The implementation fails to adequately constrain the length of the input data before copying it into a fixed-size stack buffer. Because the application logic does not perform a bounds check on the user-supplied string, an attacker can provide an excessively long payload that exceeds the allocated buffer capacity.\nThe attack flow proceeds as follows: 1) The attacker constructs a malicious HTTP request targeting the /boafrm/formPortFw endpoint. 2) The service_type argument is populated with a crafted payload, which typically includes a NOP sled, malicious shellcode, and an overwritten return address to hijack the control flow of the execution. 3) Upon receiving the request, the boa web server processes the input, triggering the insecure copy operation (likely via an unsafe string handling function such as strcpy or sprintf). 4) The overflow overwrites adjacent memory on the stack, including the saved return pointer of the formPortFw function. 5) Upon function completion, the processor attempts to return to an address controlled by the attacker, redirecting execution to the injected shellcode.\nThis vulnerability is reachable remotely over the network, and the lack of authentication requirements at this specific endpoint permits unauthenticated actors to execute the attack. Successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the web server process, which frequently runs with elevated permissions on embedded firmware. This could lead to a full device compromise, persistence installation, or further lateral movement within the local network environment."
}