Technical impact
A stack-based buffer overflow was discovered in the formMapDelDevice function of TOTOLINK A3002RU routers, caused by an unsanitized hostname parameter. When the overflow is triggered, the device's stack memory can be corrupted, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The flaw maps to CWE-121.
Affected Systems
The vulnerability affects TOTOLINK A3002RU routers running firmware version 3.0.0 or earlier, specifically up to B20220304.1804. No other vendor or product variations are listed.
Risk and Exploitability
The vulnerability has no publicly available EPSS score and is not listed in the CISA KEV catalog, yet the remote nature of the buffer overflow suggests a high likelihood of exploitation once a feasible attack vector is found. Attackers would need network access to the router's administration interface, likely via HTTP or a web‑based API that accepts hostname input. Given the severity of a stack overflow and the absence of mitigation details, the risk remains high until a fixed firmware release is deployed. The CVSS score of 7.5 indicates the high severity of the vulnerability.
