X15 Firmware CVE-2025-5737

CRITICAL real-world risk despite authentication requirement. CVSS 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects: (1) Network attack vector—no proximity required, (2) Low complexity—straightforward exploitation, (3) Low privileges—requires valid user authentication but many TOTOLINK devices ship with default credentials, (4) High impact across confidentiality, integrity, availability. The 'PR:L' (Low Privilege) requirement is mitigated by widespread default credential issues on TOTOLIK routers and the existence of pre-authentication information disclosure vulnerabilities in same product line. Public POC availability dramatically elevates EPSS (exploitation probability likely >0.85). KEV status unknown from provided data but public disclosure + active exploit code = imminent widespread exploitation. This is NOT a low-real-risk issue; it represents practical, weaponizable attack path for router compromise leading to botnet enrollment, traffic interception, or lateral network movement.

A threat actor obtains TOTOLINK X15 router credentials via: (1) default credential database scan (admin/admin), (2) password spray on exposed WAN management interface, or (3) credential theft from previous compromises. Attacker crafts HTTP POST request: POST /boafrm/formDosCfg HTTP/1.1 Content-Type: application/x-www-form-urlencoded

submit-url=[OVERFLOW_PAYLOAD_1024_BYTES]. The oversized 'submit-url' value overflows the target buffer, corrupting stack canaries and overwriting return pointer. If ASLR is disabled (common on TOTOLINK firmware), attacker executes shellcode to: spawn reverse shell, disable firewall, inject malware, or establish persistent backdoor via cron/init.d modification. Result: Router becomes part of IoT botnet (Mirai variant), MITM device for credential harvesting, or pivot point into enterprise networks. Timeline: credential acquisition (1 day) → exploitation (seconds) → persistence (minutes) → C2 communication (ongoing).