This vulnerability affects the Totolink A3002MU router firmware version Hh-B20211125.1046. The flaw exists in the formIpv6Setup function within the /boafrm/formIpv6Setup component of the boa service. By manipulating the static_ipv6 argument, an attacker can trigger a buffer overflow remotely. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity. Public exploit code is available, but there is no vendor advisory or patch information provided at this time.

Successful exploitation of this buffer overflow could allow remote attackers to execute arbitrary code or cause denial of service on the affected device. Given the critical CVSS score and public exploit availability, the risk to affected devices is high. However, no active exploitation in the wild has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to the device's management interface and monitor for suspicious activity related to IPv6 configuration requests.