TOTOLINK A702R, A3002R and A3002RU Buffer Overflow Vulnerability

A critical buffer overflow vulnerability has been identified in TOTOLINK A702R, A3002R, and A3002RU routers running version 3.0.0-B20230809.1615. The vulnerability resides in the HTTP POST request handler, specifically within the 'submit-url' function of the '/boafrm/formReflashClientTbl' file. This issue allows for remote exploitation, potentially leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can commonly lead to arbitrary code execution or a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending an HTTP POST request to the '/boafrm/formReflashClientTbl' endpoint with a payload that triggers the buffer overflow. This can be done using a variety of tools that allow for crafting and sending HTTP requests, such as curl, Postman, or custom scripts.