TOTOLINK A3002R Stack-Based Buffer Overflow Vulnerability

A critical stack-based buffer overflow vulnerability has been identified in the TOTOLINK A3002R router, specifically in the firmware version 1.1.1-B20200824.0128. The vulnerability arises in the 'formWlanMultipleAP' function of the file '/boafrm/formWlanMultipleAP', where the 'submit-url' argument can be manipulated. This overflow can be exploited remotely, potentially allowing attackers to execute arbitrary code.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, allowing for remote code execution.

Reproduction

The vulnerability can be reproduced by sending a request to the 'formWlanMultipleAP' function with a 'submit-url' argument that is excessively long. This will cause a stack-based buffer overflow, which can be exploited to execute arbitrary code.