X15 Firmware CVE-2025-5786

This vulnerability presents CRITICAL real-world risk across multiple dimensions: (1) CVSS 8.8 reflects high severity with network accessibility (AV:N), low attack complexity (AC:L), and full system compromise (C:H/I:H/A:H); (2) Requires only LOW privilege (PR:L), meaning any authenticated user (e.g., legitimate admin, compromised low-privilege account) can trigger the flaw; (3) Public proof-of-concept availability significantly increases exploitability likelihood; (4) Buffer overflows are highly automatable and reliable to exploit, especially on embedded systems with limited ASLR/DEP protections typical of consumer router firmware; (5) SSVC assessment: Exploitation status is PUBLIC (POC disclosed), technical impact is TOTAL (RCE), attack is AUTOMATABLE, meaning this should be flagged as immediate priority. Unlike many high-CVSS issues, the combination of public POC, low attack complexity, authentication requirement being minimal in practice (many routers have weak default credentials), and embedded system context (often running outdated kernels/libc) makes this genuinely high-risk for exploitation.

An attacker gains initial authentication to a TOTOLINK X15 router (via weak default credentials, password spray, or social engineering). The attacker then crafts an HTTP POST request to http://[router-ip]/boafrm/formDMZ with a maliciously oversized 'submit-url' parameter containing shellcode. The parameter value overflows the buffer, overwriting return addresses on the stack. When the vulnerable function returns, control flow is redirected to attacker-controlled code, executing arbitrary commands with root privileges (typical for router management processes). The attacker achieves full system compromise: stealing WiFi credentials/configuration, pivoting into the network, establishing persistence, or launching DDoS attacks. No user interaction is required (UI:N). Attack complexity is low—fuzzing or using publicly disclosed POC code makes exploitation trivial.