The Totolink A3002MU router firmware version B20211125.1046 contains a stack-based buffer overflow vulnerability (CVE-2026-6194) in the HTTP Request Handler component. The issue arises from improper handling of the wan-url argument in the function sub_410188 located in /boafrm/formWlanSetup. This flaw can be remotely exploited without user interaction or privileges, allowing an attacker to overflow the stack buffer. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. Although a public exploit is available, there is no vendor-provided patch or official remediation information currently. The device is not a cloud service, so remediation depends on vendor firmware updates.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause a denial of service on affected Totolink A3002MU devices running firmware B20211125.1046. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk. However, no confirmed active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix has been provided by Totolink, users should monitor for firmware updates addressing this vulnerability. Until a fix is available, consider restricting access to the device's management interface from untrusted networks to reduce exposure.