This vulnerability affects the Totolink A3002MU router firmware version Hh-B20211125.1046. The flaw exists in the formWlWds function within the /boafrm/formWlWds file, where manipulation of the submit-url argument leads to a buffer overflow condition. The vulnerability is remotely exploitable without authentication, and public exploit code is available. The CVSS 4.0 base score is 10.0, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this buffer overflow can lead to remote code execution or denial of service on the affected device, compromising the router's confidentiality, integrity, and availability. Given the public availability of exploit code, the risk of active exploitation is elevated.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, affected devices should be isolated from untrusted networks or have network-level protections applied to block exploit attempts targeting the vulnerable function.