CVE-2024-34198: Totolink A3002ru Buffer Overflow Flaw

CVE-2024-34198 Overview

CVE-2024-34198 is a stack-based buffer overflow in the TOTOLINK AC1200 Wireless Router A3002RU running firmware version V2.1.1-B20230720.1011. The formWlEncrypt CGI handler in the boa web server does not validate the length of the wlan_ssid parameter received from HTTP requests. Attackers can send a crafted request with an oversized wlan_ssid value to corrupt the stack. Successful exploitation enables arbitrary command execution or denial-of-service against the router. The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input).

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands on affected TOTOLINK A3002RU routers through a single malformed HTTP request to the formWlEncrypt endpoint.

Affected Products

• TOTOLINK AC1200 Wireless Router A3002RU (hardware)
• TOTOLINK A3002RU firmware version V2.1.1-B20230720.1011
• Deployments exposing the boa web management interface to untrusted networks

Discovery Timeline

• 2024-08-28 - CVE-2024-34198 published to the National Vulnerability Database
• 2025-07-03 - Last updated in NVD database

Technical Details for CVE-2024-34198

Vulnerability Analysis

The flaw resides in the formWlEncrypt request handler inside the boa HTTP server binary shipped with the TOTOLINK A3002RU firmware. The handler reads the wlan_ssid form field directly from a client-supplied HTTP request and copies it into a fixed-size stack buffer without bounds checking. Supplying a value longer than the destination buffer overwrites adjacent stack memory, including the saved return address. Because the router runs the boa process with elevated privileges and no exploit mitigations such as ASLR or stack canaries on most consumer router firmware, control flow hijack translates directly into arbitrary command execution.

Root Cause

The root cause is missing input length validation on the wlan_ssid parameter. The handler trusts attacker-controlled HTTP data and performs an unchecked string copy operation into a stack buffer. This pattern is documented under [CWE-120] and is common across embedded MIPS-based router firmware that uses the boa web server.

Attack Vector

An unauthenticated attacker with network reachability to the router's HTTP management interface can exploit this issue. The attacker crafts an HTTP POST request to the formWlEncrypt CGI endpoint with an excessively long wlan_ssid value. The malformed request triggers the stack overflow during request parsing. Public proof-of-concept material is available in a GitHub Gist Exploit PoC that documents the offending field and payload structure. No authentication, user interaction, or local access is required.

No verified code examples are provided. Refer to the linked PoC for parameter offsets and payload layout.

Detection Methods for CVE-2024-34198

Indicators of Compromise

• HTTP POST requests to the formWlEncrypt endpoint containing an unusually long wlan_ssid value, typically exceeding several hundred bytes.
• Unexpected restarts or crashes of the boa web server process on the router.
• Outbound connections initiated from the router to unfamiliar hosts following inbound management-interface traffic.

Detection Strategies

• Inspect network traffic destined for the router's HTTP management port and flag requests targeting formWlEncrypt with non-standard SSID lengths.
• Apply intrusion detection signatures that match oversized form parameters in CGI requests against boa-based embedded servers.
• Correlate router reboots or interface flapping with prior administrative HTTP traffic from untrusted sources.

Monitoring Recommendations

• Restrict and log all access to router administrative interfaces from internal monitoring sensors.
• Forward router syslog events to a central log platform and alert on repeated CGI request failures.
• Track firmware versions across the fleet so that vulnerable V2.1.1-B20230720.1011 builds are identified for prioritized remediation.

How to Mitigate CVE-2024-34198

Immediate Actions Required

• Disable remote WAN-side access to the router web administration interface.
• Restrict LAN-side access to the management interface to a dedicated administrative VLAN or trusted hosts only.
• Audit deployed TOTOLINK A3002RU devices and identify any units running firmware V2.1.1-B20230720.1011.
• Replace end-of-life devices when no vendor patch is available for the affected firmware build.

Patch Information

No vendor advisory or fixed firmware version is listed in the published CVE data. Operators should monitor the TOTOLINK support portal for updated firmware addressing the formWlEncrypt handler and apply any released update immediately. Until a fix is available, treat affected devices as exposed and apply compensating controls.

Workarounds

• Block inbound connections to the router HTTP management port at the perimeter firewall.
• Place vulnerable routers behind a network segment that denies untrusted clients access to the management interface.
• Replace the affected model with a supported device if no firmware update is published by the vendor.

# Example: restrict access to the router management interface on an upstream firewall
# Allow only an administrative host to reach the router web UI
iptables -A FORWARD -s 192.0.2.10 -d <router_ip> -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -j DROP