X15 Firmware CVE-2025-5739

CVSS 8.8 (High/Critical) indicates significant severity with network-accessible attack vector (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L), combined with complete impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The authentication requirement (PR:L) moderately reduces exposure but does not eliminate risk, as default credentials are common in IoT/router devices. Public disclosure and available POC evidence elevate real-world exploitation probability substantially. Without EPSS data or KEV/CISA ADP status explicitly provided, the public POC availability and low AC/PR characteristics suggest this is ACTIVELY EXPLOITABLE in the wild. This is NOT a theoretical high-CVSS issue—the combination of low attack complexity, public POC, and critical impact makes this a tier-1 priority for organizations deploying TOTOLINK X15 devices. Attack surface is broad: any network segment with access to the router's web management interface represents an entry point.

An authenticated attacker (either via default credentials, credential compromise, or initial network access) sends a crafted HTTP POST request to http://[router-ip]/boafrm/formSaveConfig with an oversized 'submit-url' parameter containing shellcode or ROP gadget chains. Due to insufficient bounds checking, the payload overwrites stack memory including saved return addresses or heap metadata. Control flow redirects to attacker-supplied code, enabling arbitrary command execution with router privileges. Attacker gains full device compromise: ability to steal network credentials, intercept traffic, pivot to internal network, or render the device inoperable. The low attack complexity (AC:L) means no special timing, conditions, or user interaction is required—a single malicious POST request suffices. Public POC tools automate this attack, reducing barrier to entry for opportunistic threat actors.