Submit #977222: TOTOLINK A3002MU V1.0.0-B20230403.1455 Stack-based Buffer Overflow

The URL-filter handler of the TOTOLINK A3002MU copies a request parameter into a fixed-size stack buffer without any bounds check. The handler is entered by posting to /boafrm/formFilter with a non-empty addFilterUrl field, after which the url parameter is read through the generic parameter getter sub_4101C8. That getter applies a 4096-byte upper bound and performs URL decoding, but it imposes no restriction on the content of the value, and the decoded value may contain NUL bytes and arbitrary binary data because the POST body is length-delimited rather than string-terminated. The only transformation applied to the parameter is an in-place conversion to lower case; no length check is performed. The value is then passed to strcpy() with a 36-byte stack buffer as the destination. Because the source is attacker-controlled and may be up to 4096 bytes, the copy writes far beyond the end of the destination and over the remainder of the frame, including the saved return address. The frame is 776 bytes in total and the saved return address sits 656 bytes above the start of the buffer, so a parameter of 660 bytes is sufficient to overwrite it completely. The target binary is a non-PIE MIPS32 little-endian executable loaded at a fixed base of 0x400000, it is built without stack canaries, and the vendor firmware does not enable address-space layout randomisation, so the addresses of gadgets and of the loaded libraries are stable across reboots and can be hard-coded in a payload. The result is a deterministic control-flow hijack that can be developed into arbitrary code execution in the context of the web server, which runs as root; at minimum it yields a reliable denial of service.

• Source: ⚠️ https://gist.github.com/H3rmesk1t/ad06bb4121f7654c181d64bad5d7f354
• User: H3rmesk1t (UID 70306)
• Submission: 09/14/2026 10:59 (21 days ago)
• Moderation: 10/05/2026 00:18 (21 days later)
• Status: Duplicate
• VulDB entry: 403181 [Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2 includes/process.php cross-site request forgery]
• Points: 0