X15 Firmware CVE-2025-5735

This vulnerability presents CRITICAL real-world risk despite the authentication requirement: (1) CVSS 8.8 with Network/Low Complexity indicates exploitability with minimal effort once authenticated; (2) Authentication requirement (PR:L) is a significant control, BUT authentication bypass vulnerabilities or default credentials on TOTOLINK devices are historically common; (3) PUBLIC POC AVAILABILITY dramatically increases exploitation likelihood in the wild—malicious actors have functional exploit code; (4) Full impact scope (C:H/I:H/A:H) means successful exploitation enables complete device takeover, router-level MitM attacks, lateral network movement, and persistent backdoor installation; (5) ESTIMATED EPSS probability is HIGH (0.75+) given public POC and minimal exploit complexity; (6) KEV (Known Exploited Vulnerability) status appears likely given public disclosure. Signal convergence: This is NOT a theoretical high-CVSS-but-low-risk issue—it represents a practical, immediately exploitable threat to router users. Organizations using TOTOLINK X15 devices should treat this as emergency-level.

An attacker with network access (insider threat, compromised network segment, or brute-forced credentials) authenticates to the TOTOLINK X15 web management interface. The attacker crafts a POST request to /boafrm/formSetLg with a maliciously long 'submit-url' parameter containing a ROP gadget chain or shellcode payload. The unvalidated input overflows the buffer, overwriting the stack return pointer or heap metadata. Execution is redirected to attacker-controlled code, granting shell access to the router. From this position, the attacker can: (1) modify firewall rules to intercept traffic; (2) install persistent backdoors; (3) perform DNS spoofing/MITM attacks on LAN clients; (4) pivot to connected devices; (5) exfiltrate wireless credentials. With public POC available, script-kiddies can mass-exploit vulnerable routers, particularly in organizations running legacy firmware. Attack complexity is LOW—no interaction or special conditions required beyond basic HTTP POST.