important · Firmware — Router
A LAN request can overwrite the saved return address in a TOTOLINK A3002MU root process.
Affects
TOTOLINK A3002MU, an embedded AC1200 home router running a MIPS Boa management service.
An unauthenticated formFilter request sends an up-to-4096-byte URL into a 36-byte stack buffer, overwriting the saved MIPS return address at offset 656.
Detail and 1 source
The trigger is public, but arbitrary command execution on stock hardware has not been demonstrated.
Chain to watch
Reach the router's LAN management interface.→↓Overwrite the saved return address while retaining space for a ROP chain.→↓Demonstrate a benign command on stock hardware.→↓Arbitrary command execution on stock hardware remains unproven.
Unverified chainRun a benign ROP payload that records id output on firmware V1.0.0-B20230403.1455.