TOTOlink A3002R Buffer Overflow Vulnerability in IPv6 Setup Interface

A buffer overflow vulnerability has been identified in the TOTOlink A3002R router, specifically in version 1.1.1-B20200824.0128. The issue arises from inadequate input validation of the static_ipv6 parameter within the formIpv6Setup interface, which is managed by the Boa web server.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

To reproduce this vulnerability, access the formIpv6Setup interface of the TOTOlink A3002R router running the vulnerable version. Submit a crafted request that includes an overly long static_ipv6 parameter, which will trigger the buffer overflow by exceeding the allocated memory buffer size.