Description

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-19T06:16:30.557Z",
  "pubdate": "2026-09-19T06:16:30.557Z",
  "executiveSummary": "A critical security vulnerability has been identified in the Totolink A3002MU router running firmware version Hh-B20211125.1046. This flaw is classified as a stack-based buffer overflow within the web management interface, specifically affecting the 'formWlWds' function located in the '/boafrm/formWlWds' path. The vulnerability arises from improper validation of user-supplied input length before copying data into a fixed-size memory buffer.\nAn unauthenticated or authenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request containing an excessively long 'submit-url' argument. Successful exploitation allows the attacker to overwrite adjacent stack memory, potentially altering the execution flow to run arbitrary code with elevated system privileges (typically root on embedded Linux devices). If code execution is not achieved, the exploit will cause the web server daemon to crash, leading to a persistent denial-of-service condition. Because public exploit code exists, the likelihood of opportunistic attacks targeting exposed management interfaces of affected routers is high, necessitating immediate mitigation and access control restrictions.",
  "technicalDetails": "The vulnerability resides in the HTTP daemon (boa) of the Totolink A3002MU router, specifically within the handling of the '/boafrm/formWlWds' endpoint which manages Wireless Distribution System (WDS) configuration. When a client submits an HTTP POST request to this endpoint, the request is parsed, and the parameters are processed by the associated handler function 'formWlWds'.\nDuring execution, the function retrieves the value of the 'submit-url' parameter from the incoming request. The root cause of the vulnerability is the lack of boundary checking and size validation on this parameter before it is copied into a local buffer allocated on the stack. The software likely utilizes an unsafe string manipulation function, such as 'strcpy' or 'sprintf', to duplicate or format the 'submit-url' value.\nAn attacker can exploit this by crafting an HTTP request where the 'submit-url' parameter exceeds the allocated buffer size. As the application copies the parameter value into memory, it overwrites the buffer boundaries, overflowing into the adjacent stack frame. This memory corruption can overwrite local variables, the saved frame pointer, and ultimately the return address of the function.\nSpecifically, because the Totolink A3002MU operates on a MIPS architecture, functions do not save the return address on the stack in the same manner as x86; instead, the return address is stored in the $ra register and saved to the stack frame if the function is non-leaf. When 'formWlWds' prepares to return, it loads the saved return address from the stack back into the $ra register and executes a 'jr $ra' instruction. By overflowing the stack buffer, the attacker overwrites this saved $ra value. This allows direct redirection of the program counter to arbitrary locations, such as shellcode injected into the buffer or system library functions.\nBy control-flow hijacking, an attacker can overwrite the return address with the address of a malicious payload or leverage Return-Oriented Programming (ROP) gadgets present in the router's firmware libraries (such as uClibc) to execute arbitrary shell commands. This execution typically occurs within the security context of the web server process, which runs with root privileges on Totolink devices.\nThe attack vector is network-based and can be executed remotely if the web management interface of the router is exposed to the WAN or accessible via the local network. No complex user interaction is required to trigger the overflow, and depending on the specific implementation, authentication might be bypassed or bypassed if the endpoint does not strictly enforce session validation prior to parsing the post data."
}