The vulnerability is a stack-based buffer overflow caused by insufficient bounds checking of the routernamer parameter in the formDnsv6 function of TOTOLINK A3002RU firmware. This flaw allows an attacker to corrupt stack memory, potentially enabling arbitrary code execution or denial of service. It corresponds to CWE-121 and CWE-787 weaknesses.

The flaw impacts TOTOLINK A3002RU routers running firmware version 2.1.1-B20211108.1455. No other versions or product lines are known to be affected by this specific issue.

The CVSS score of 8.0 indicates a high severity impact. With an EPSS score of less than 1 %, the likelihood of real-world exploitation is low, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nevertheless, the remote nature of the formDnsv6 interface suggests that an attacker with network access to the router could trigger the overflow, potentially leading to full compromise of the device.