What is the CVSS score of CVE-2025-5788?

CVE-2025-5788 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of X15 Firmware are affected by CVE-2025-5788?

A critical remote code execution vulnerability affects TOTOLIK X15 routers (firmware 1.0.0-B20230714.1105) with no patch currently available.

How to fix or mitigate CVE-2025-5788?

Within 24 hours: Inventory all TOTOLINK X15 devices and isolate affected units from critical network segments if possible. Within 7 days: Implement network access controls to restrict HTTP POST requests to the /boafrm/formReflashClientTbl endpoint and monitor for exploitation attempts. Within 30 days: Contact TOTOLINK for patch availability, evaluate firmware upgrade timelines, and develop a replacement strategy if patches are not forthcoming.

X15 Firmware CVE-2025-5788

EUVD-2025-17328 HIGH

Buffer Overflow (CWE-119)

2025-06-06 cna@vuldb.com

Buffer Overflow TP-Link X15 Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17328

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 17:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formReflashClientTbl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical buffer overflow vulnerability in TOTOLINK X15 router firmware version 1.0.0-B20230714.1105, affecting the HTTP POST request handler at endpoint /boafrm/formReflashClientTbl. An authenticated remote attacker can exploit improper argument validation in the 'submit-url' parameter to achieve complete system compromise including confidentiality, integrity, and availability breaches. Public exploit code exists and the vulnerability meets CISA KEV criteria for active exploitation risk.

Technical ContextAI

The vulnerability resides in the HTTP POST request handler component of TOTOLINK's web-based device management interface, specifically in the /boafrm/formReflashClientTbl endpoint. The root cause is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating a classic stack or heap-based buffer overflow condition. The vulnerable code fails to properly validate or sanitize the 'submit-url' parameter length before copying it into a fixed-size buffer, allowing an attacker to write beyond buffer boundaries. This affects the firmware of TOTOLINK X15 router models running build B20230714.1105 and potentially earlier versions. The affected CPE is CPE:2.3:o:totolink:x15_firmware:1.0.0-b20230714.1105:*:*:*:*:*:*:*. The vulnerability exists in firmware-level code responsible for client table reflashing operations, which may interact with critical system processes.

RemediationAI

Patch/Upgrade: Contact TOTOLINK support or check the official TOTOLINK support portal for firmware updates released after 2023-07-14. Update the X15 router firmware to the latest available version that addresses CVE-2025-5788.; priority: CRITICAL Network Segmentation: Restrict HTTP POST access to the /boafrm/formReflashClientTbl endpoint using firewall rules or access control lists. Only allow administrative access from trusted IP ranges.; priority: HIGH Credential Hardening: Change default router credentials immediately and enforce strong, unique passwords for all administrative accounts to reduce the likelihood of authentication bypass.; priority: HIGH Access Monitoring: Monitor router logs for suspicious POST requests to /boafrm/formReflashClientTbl with unusual submit-url parameter lengths or values.; priority: MEDIUM Disable Remote Management: Disable remote HTTP/HTTPS management access if not required; configure access only from local network.; priority: MEDIUM