This vulnerability in Totolink A3002MU firmware version Hh-B20211125.1046 affects the formWlEncrypt function in the /boafrm/formWlEncrypt file. Manipulating the submit-url argument leads to a buffer overflow condition that can be exploited remotely without authentication or user interaction. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The exploit is publicly available, but no official patch or mitigation guidance has been provided.

Successful exploitation of this buffer overflow vulnerability can lead to arbitrary code execution or denial of service on the affected device. Given the critical CVSS score and remote attack vector, attackers can compromise the device remotely without authentication, potentially leading to full device compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the affected device's management interfaces to trusted sources only to reduce exposure.