What is the CVSS score of CVE-2025-5738?

CVE-2025-5738 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of X15 Firmware are affected by CVE-2025-5738?

A critical buffer overflow vulnerability (CVE-2025-5738) affects TOTOLINK X15 routers with no vendor patch currently available.

How to fix or mitigate CVE-2025-5738?

Within 24 hours: Identify and inventory all TOTOLINK X15 devices in production; isolate affected devices from critical networks if possible. Within 7 days: Implement network segmentation to restrict access to the /boafrm/formStats endpoint; deploy WAF rules to block suspicious submit-url parameter submissions; consider disabling remote management if not operationally required. Within 30 days: Evaluate replacement with patched firmware versions or alternative vendor equipment; monitor for vendor security updates and apply immediately upon release.

X15 Firmware CVE-2025-5738

EUVD-2025-17105 HIGH

Buffer Overflow (CWE-119)

2025-06-06 cna@vuldb.com

Buffer Overflow TP-Link RCE X15 Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17105

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 09:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formStats of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical buffer overflow vulnerability in TOTOLINK X15 router (firmware version 1.0.0-B20230714.1105) affecting the HTTP POST request handler at endpoint /boafrm/formStats. An authenticated remote attacker can exploit improper input validation on the 'submit-url' parameter to trigger a buffer overflow, achieving remote code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code is available and the vulnerability is actively exploitable.

Technical ContextAI

The vulnerability exists in a web-based firmware management interface (likely Boa web server, common in TOTOLINK routers) that processes HTTP POST requests. The affected endpoint /boafrm/formStats handles form submissions without proper bounds checking on the 'submit-url' parameter. This represents a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) stack or heap buffer overflow. The root cause is insufficient input validation and lack of safe string handling functions (likely strcpy or similar unbounded copy operations rather than strncpy/strlcpy equivalents). TOTOLINK X15 is a budget consumer Wi-Fi router; the vulnerability affects the administrative web interface which processes user-supplied data without sanitization. The HTTP POST handler directly passes unsanitized user input to a buffer with fixed dimensions.

RemediationAI

Immediate remediation steps: (1) Check TOTOLINK official website and product support pages for patched firmware releases (typically versioned higher than 1.0.0-B20230714.1105); (2) If available, apply latest firmware update via router admin panel (Administration > Firmware Upgrade); (3) As interim mitigation, restrict administrative access: disable remote management (ensure WAN access to admin interface is disabled), enforce strong admin credentials (change from defaults), and isolate router admin interface to trusted networks only; (4) Monitor for suspicious /boafrm/formStats POST requests in router logs if accessible; (5) Consider replacing the router if TOTOLINK does not release a patch within 90 days or discontinues support (TOTOLINK has poor track record of timely firmware updates). No vendor advisory URL was provided in the CVE description; check TOTOLINK's security page, OpenWrt community, or vulnerability databases for patches.