X15 Firmware CVE-2025-5788

This vulnerability presents exceptional real-world risk despite requiring authentication (PR:L). Risk signals align strongly: CVSS 8.8 reflects high severity (confidentiality, integrity, availability all compromised); the CVSS vector shows AV:N (network-accessible), AC:L (low complexity exploitation), and PR:L (requires low-privilege authentication, which many devices grant by default or through weak credential brute-forcing). The public disclosure of exploit code transforms this from theoretical to immediate danger. KEV confirmation indicates CISA has validated active exploitation in the wild. EPSS score would likely be elevated (>0.90) given public POC availability, network accessibility, and authentication bypass potential. SSVC analysis: exploitation maturity is proven (public POC), attack automation is highly feasible (POST-based buffer overflow), and technical impact is complete (CWE-119 leads to RCE/code execution). This is not a low-risk high-CVSS issue; it is a genuine critical priority for all TOTOLINK X15 users. Devices are often deployed in consumer and small-business networks with default or shared credentials, lowering the effective PR barrier.

An attacker performs reconnaissance to identify TOTOLINK X15 routers exposed on the internet or within a network. The attacker obtains or guesses weak administrative credentials (common default credentials or via credential stuffing). The attacker crafts an HTTP POST request to http://<target-ip>/boafrm/formReflashClientTbl with the 'submit-url' parameter containing a specially crafted payload exceeding the buffer size (e.g., 1000+ characters of controlled data). The oversized submit-url parameter triggers a stack-based buffer overflow, overwriting the return address or other critical stack data. The attacker redirects execution to injected shellcode or ROP gadgets, achieving arbitrary code execution with the privileges of the web server process (typically root on embedded devices). This grants complete remote code execution, allowing the attacker to install backdoors, exfiltrate credentials, launch further network attacks, or render the device inoperable. Public POC tools automate this process, making it accessible to low-skill attackers.