TOTOlink A3002R Buffer Overflow Vulnerability in IPv6 Setup Interface

A buffer overflow vulnerability has been identified in the TOTOlink A3002R router, specifically in version 1.1.1-B20200824.0128. The issue arises from inadequate input validation of the static_gw parameter within the formIpv6Setup interface, which is handled by the Boa web server.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

To reproduce this vulnerability, access the router's web interface and navigate to the IPv6 setup section. When prompted to enter a static gateway, provide an input that exceeds the expected length. This will trigger the buffer overflow by overwriting adjacent memory.