CVE-2025-4733: Totolink A3002r Buffer Overflow Vulnerability

CVE-2025-4733 Overview

CVE-2025-4733 is a buffer overflow vulnerability affecting TOTOLINK A3002R and A3002RU routers running firmware version 3.0.0-B20230809.1615. The flaw resides in the HTTP POST request handler for the /boafrm/formIpQoS endpoint. Attackers can trigger memory corruption by manipulating the mac argument in crafted POST requests. The vulnerability is remotely exploitable across the network and requires only low-level privileges. Exploitation details have been publicly disclosed, increasing the risk of weaponization against exposed devices. The weakness is classified under CWE-119 for improper restriction of operations within memory buffer bounds.

Critical Impact
Remote authenticated attackers can corrupt router memory through the mac parameter, potentially achieving arbitrary code execution and full device compromise on affected TOTOLINK A3002R and A3002RU units.

Affected Products

TOTOLINK A3002R firmware 3.0.0-B20230809.1615
TOTOLINK A3002RU firmware 3.0.0-B20230809.1615
TOTOLINK A3002R and A3002RU hardware appliances running the affected firmware

Discovery Timeline

2025-05-16 - CVE-2025-4733 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4733

Vulnerability Analysis

The vulnerability exists in the formIpQoS handler exposed by the router's boa web server at /boafrm/formIpQoS. The handler processes HTTP POST submissions used to configure IP-based Quality of Service rules. When parsing the mac parameter, the firmware copies attacker-controlled input into a fixed-size stack or heap buffer without enforcing length validation. Supplying an oversized value overflows the destination buffer and corrupts adjacent memory structures.

The issue is tracked under CWE-119, reflecting improper bounds checking during buffer operations. Because the boa HTTP daemon on TOTOLINK devices typically runs with elevated privileges, successful exploitation can lead to control over the device. The EPSS score for this issue is 0.661% with a percentile of 46.8, indicating moderate predicted exploitation activity for a publicly disclosed router flaw.

Root Cause

The root cause is missing input length validation in the formIpQoS request handler. The handler treats the mac value as a trusted, well-formed MAC address string and copies it directly into a fixed-size buffer using an unsafe string operation. No upper bound is enforced before the copy, allowing attacker-supplied data to overrun the buffer and overwrite adjacent stack frames or heap metadata.

Attack Vector

The attack vector is network-based. An attacker with access to the router's HTTP management interface and at least low-privilege credentials submits a POST request to /boafrm/formIpQoS containing an excessively long mac field. The request triggers the buffer overflow during parameter handling inside the boa web server. Depending on memory layout and protections, the overflow can crash the daemon or be shaped into arbitrary code execution. Devices exposing the management interface to untrusted networks face the highest risk.

No verified proof-of-concept code is included here. Technical details are referenced in the public disclosure document on GitHub and the VulDB entry #309035.

Detection Methods for CVE-2025-4733

Indicators of Compromise

HTTP POST requests to /boafrm/formIpQoS containing oversized or malformed mac parameter values exceeding typical MAC address length of 17 characters.
Unexpected restarts or crashes of the boa HTTP daemon on affected TOTOLINK A3002R and A3002RU devices.
New or unexplained outbound connections from the router to unknown hosts following management interface activity.
Unauthorized configuration changes to QoS, firewall, or DNS settings following access to the web administration interface.

Detection Strategies

Inspect web server and reverse proxy logs for POST requests targeting /boafrm/formIpQoS with abnormal payload sizes or non-MAC content in the mac field.
Deploy network intrusion detection signatures that match oversized parameter values against the formIpQoS URI on TOTOLINK devices.
Correlate authentication events against the router admin interface with subsequent crashes or configuration drift to surface exploitation attempts.

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized SIEM or data lake for long-term retention and correlation.
Alert on any external source addresses reaching the router's HTTP management port and on repeated POSTs to QoS configuration endpoints.
Monitor firmware integrity and configuration baselines to identify post-exploitation tampering on perimeter devices.

How to Mitigate CVE-2025-4733

Immediate Actions Required

Restrict access to the router's HTTP administration interface to trusted management networks only and disable any WAN-side management exposure.
Rotate administrator credentials on affected A3002R and A3002RU devices, since exploitation requires low-level authenticated access.
Audit current firmware versions and identify all TOTOLINK A3002R/A3002RU devices running 3.0.0-B20230809.1615.
Review router configuration and logs for signs of unauthorized changes or exploitation attempts against /boafrm/formIpQoS.

Patch Information

No vendor security advisory or fixed firmware version has been published in the referenced sources at the time of disclosure. Consult TOTOLINK Security Resources for any subsequent firmware releases addressing this issue and apply updates as soon as they become available.

Workarounds

Disable remote (WAN) administration on the router and limit LAN-side access to a dedicated management VLAN.
Place affected devices behind a network firewall that blocks unsolicited HTTP/HTTPS traffic to the router's management interface.
Replace end-of-life or unsupported TOTOLINK A3002R/A3002RU units with currently supported hardware where no patch is forthcoming.
Enforce strong, unique credentials for all router accounts to reduce the likelihood of low-privilege access being obtained.

bash

# Example: restrict router HTTP admin to a single management host using upstream firewall rules
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <mgmt_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <mgmt_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP