This vulnerability affects the Totolink A3002MU router firmware version Hh-B20211125.1046. The issue lies in the formSchedule function within the /boafrm/formSchedule file, where improper handling of the webpage argument leads to a buffer overflow condition. The vulnerability can be exploited remotely without user interaction, and public exploit code exists. The CVSS 4.0 base score is 9.4, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high scope impact.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. Given the critical CVSS score and public exploit availability, the risk of compromise is significant. The vulnerability affects core router functionality, potentially impacting network security and device stability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure of the affected device to untrusted networks and monitor vendor communications for updates.