A buffer overflow exists in the setAppEasyWizardConfig function of the app.so library on Totolink A3600R firmware 5.9c.4959. By crafting a malicious apcliSsid argument, an attacker can overwrite critical memory and potentially execute arbitrary code on the device. The flaw is identified as a Classic Stack Smashing exception (CWE-119) and an Improper Bounds Checking (CWE-120).

All Totolink A3600R units running firmware 5.9c.4959. The vulnerability is specific to the app.so module and does not affect older firmware versions unless they contain the same implementation of setAppEasyWizardConfig.

The vulnerability carries a CVSS score of 8.7, indicating high severity, but the EPSS score is less than 1%, suggesting low current exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote, likely through network-based configuration interfaces that accept the apcliSsid parameter. Because the exploit code is publicly available, it is feasible for attackers to trigger the buffer overflow from outside the local network if the configuration service is exposed.