What is the CVSS score of CVE-2025-5736?

CVE-2025-5736 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of X15 Firmware are affected by CVE-2025-5736?

A critical buffer overflow vulnerability in TOTOLIK X15 routers (CVE-2025-5736) allows remote attackers to potentially execute arbitrary code without authentication.

How to fix or mitigate CVE-2025-5736?

Within 24 hours: Identify and inventory all TOTOLINK X15 devices in your environment and isolate them from critical network segments. Within 7 days: Evaluate replacement options or implement emergency network segmentation to restrict device access to essential functions only. Within 30 days: Deploy replacement devices from vendors with proven security track records, or confirm vendor patch release and implement immediately upon availability.

X15 Firmware CVE-2025-5736

EUVD-2025-17094 HIGH

Buffer Overflow (CWE-119)

2025-06-06 cna@vuldb.com

Buffer Overflow TP-Link RCE X15 Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17094

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 08:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formNtp of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical buffer overflow vulnerability exists in TOTOLINK X15 firmware version 1.0.0-B20230714.1105 affecting the NTP configuration handler (/boafrm/formNtp). An authenticated attacker can remotely trigger a buffer overflow via the 'submit-url' parameter in HTTP POST requests, achieving remote code execution with high confidentiality, integrity, and availability impact. Public exploit code is available and the vulnerability meets active exploitation criteria.

Technical ContextAI

The vulnerability resides in the HTTP POST request handler for NTP (Network Time Protocol) configuration in TOTOLINK X15 routers. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), specifically a classic buffer overflow condition where user-supplied input from the 'submit-url' parameter is written to a fixed-size buffer without proper bounds checking. The affected component is the web administration interface running on the device, likely a proprietary firmware management service. The /boafrm/formNtp endpoint processes NTP settings but fails to validate input length, allowing attackers to overflow the heap or stack and corrupt adjacent memory structures, potentially achieving arbitrary code execution within the router's privileged context.

RemediationAI

Immediate action required: (1) Check TOTOLINK security advisories and firmware releases for patched versions beyond 1.0.0-B20230714.1105; (2) If patched firmware is available, schedule immediate deployment to all affected X15 devices, prioritizing production/critical infrastructure deployments; (3) Interim mitigations pending patch availability: restrict access to the web administration interface to trusted IP addresses only via firewall/access control lists; disable remote management features if not required; implement network segmentation to isolate router management traffic; enforce strong authentication credentials (non-default passwords) and consider disabling HTTP access in favor of HTTPS-only with certificate pinning; (4) Monitor device logs for POST requests to /boafrm/formNtp with abnormally large 'submit-url' parameter values, which may indicate exploitation attempts; (5) Contact TOTOLINK support (http://www.totolink.net or regional support channels) for patch availability and advisories; (6) Consider replacement with alternative vendor solutions if TOTOLINK does not provide timely security updates.