X15 Firmware CVE-2025-5734

This vulnerability presents HIGH real-world risk despite requiring authenticated access (PR:L in CVSS). Risk signals: (1) CVSS 8.8 with AV:N (network-exploitable) and high impact (C:H/I:H/A:H) indicating severe potential consequences; (2) Public POC availability dramatically increases exploitation likelihood—threat actors have weaponized code; (3) AC:L indicates no exploitation complexity; (4) Likely high EPSS score given public POC and network accessibility; (5) KEV status unknown from provided data but public disclosure suggests potential CISA tracking; (6) Authentication requirement (PR:L) is a moderate mitigating factor—however, router admin credentials are frequently compromised or default-configured, reducing this protection's real-world value. SSVC analysis: exploitation is NOW ACTIVE (public POC), technical impact is TOTAL (arbitrary code execution on network device), and this is NOT easily automatable at scale but IS easily targetable against known vulnerable instances. Priority: CRITICAL for organizations operating TOTOLINK X15 devices, especially if internet-facing or on shared networks.

A threat actor gains access to a TOTOLINK X15 router's admin panel (via compromised credentials, social engineering, or default credentials on a newly deployed device). The attacker crafts a malicious HTTP POST request to /boafrm/formWlanRedirect with an oversized 'redirect-url' parameter containing shellcode. The buffer overflow overwrites stack memory, redirecting execution to the attacker's payload. The attacker achieves remote code execution with router privileges, allowing them to: (1) intercept all network traffic passing through the device, (2) inject malicious content into web pages, (3) modify DNS settings for phishing attacks, (4) use the router as a botnet node, or (5) pivot to compromise downstream devices on the network. With public POC available, this attack can be scripted and deployed rapidly against identified vulnerable instances. The attack requires only network access to the router's management interface and valid credentials, both of which are commonly available in real-world deployments.