TOTOLINK A3002RU Buffer Overflow Vulnerability via HTTP POST Request

A critical buffer overflow vulnerability has been identified in the TOTOLINK A3002RU router, specifically in version 3.0.0-B20230809.1615. The issue arises within the HTTP POST request handler, particularly in the file '/boafrm/formSysLog'. The vulnerability can be exploited remotely by manipulating the 'submit-url' argument, leading to a buffer overflow condition.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can commonly lead to arbitrary code execution or a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a malicious HTTP POST request to the '/boafrm/formSysLog' endpoint, with the 'submit-url' argument crafted to trigger the buffer overflow.