The firmware revision B20211125.1046 of the Totolink A3002MU contains a stack-based buffer overflow in the HTTP Request Handler function sub_410188, triggered by submitting a manipulated wan‑url argument through the /boafrm/formWlanSetup endpoint. This flaw can be abused by a remote actor to overflow local stack buffers, potentially leading to arbitrary code execution or a denial‑of‑service condition. The vendor notes that remote exploitation is possible and that an exploit has already been made public.

The affected device is the Totolink A3002MU router running firmware version B20211125.1046. The vulnerability resides in the HTTP Request Handler component accessed via the web administration interface.

The CVSS v3.1 score of 8.7 indicates a high severity, while the EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered remotely via standard HTTP requests and successful exploitation is publicly available, the risk is significant for any network that exposes the router’s WAN configuration interface.