What is the CVSS score of CVE-2025-5786?

CVE-2025-5786 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of X15 Firmware are affected by CVE-2025-5786?

A critical buffer overflow vulnerability affecting TOTOLINK X15 routers allows remote attackers to execute arbitrary code without authentication.

How to fix or mitigate CVE-2025-5786?

Within 24 hours: Identify all TOTOLINK X15 devices in production and isolate them to a separate management network segment; disable remote HTTP access if operationally feasible. Within 7 days: Deploy WAF rules to block malicious POST requests to /boafrm/formDMZ endpoint; implement strict input validation; consider replacing affected devices with patched alternatives from vendor or competitors. Within 30 days: Complete device replacement or retire affected models; establish vendor communication protocol for security updates and evaluate TOTOLINK's patch history before future deployments.

X15 Firmware CVE-2025-5786

EUVD-2025-17323 HIGH

Buffer Overflow (CWE-119)

2025-06-06 cna@vuldb.com

Buffer Overflow TP-Link RCE X15 Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17323

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 17:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formDMZ of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical buffer overflow vulnerability in TOTOLINK X15 1.0.0-B20230714.1105 affecting the DMZ configuration HTTP POST handler. An authenticated attacker can exploit a malformed 'submit-url' parameter in the /boafrm/formDMZ endpoint to achieve remote code execution with full system compromise (confidentiality, integrity, and availability impact). A proof-of-concept exploit has been publicly disclosed, and the vulnerability may be actively exploited in the wild.

Technical ContextAI

The vulnerability exists in the HTTP POST request handler component of TOTOLIK X15 router firmware, specifically within the /boafrm/formDMZ endpoint that processes DMZ (Demilitarized Zone) configuration requests. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow flaw where user-supplied input in the 'submit-url' parameter is not properly validated or length-checked before being copied into a fixed-size buffer. TOTOLINK X15 is a residential/SOHO WiFi router (CPE likely: cpe:2.3:o:totolink:x15_firmware:1.0.0-b20230714.1105:*:*:*:*:*:*:*). The HTTP POST handler fails to implement bounds checking, allowing an attacker to overflow the buffer and overwrite adjacent memory regions, including the stack or heap, leading to arbitrary code execution.

RemediationAI

Monitor TOTOLINK official channels for security updates; apply immediately upon release Network Mitigation: Implement network-level access controls; disable remote management if not required; use strong, unique admin credentials Workaround: Assess business need for DMZ; if optional, disable via firmware settings or network segmentation Detection: Enable verbose logging; alert on POST requests with payloads >256 bytes to this endpoint