X15 Firmware CVE-2025-5790

CVSS v3.1 score of 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates significant severity. Attack Vector (Network), low Attack Complexity, and requirement for low privileges (authenticated user) make this highly exploitable in practice. The vulnerability requires valid authentication credentials but no user interaction. Public exploit disclosure combined with CVSS 8.8 suggests EPSS probability is likely elevated (typically >0.70 for publicly disclosed buffer overflows). KEV (Known Exploited Vulnerability) status and POC availability transform this from theoretical to actively exploited threat. Real-world risk is CRITICAL: the combination of (1) authenticated but low-privilege requirement, (2) network-accessible interface, (3) complete CIA impact, (4) public exploit code, and (5) buffer overflow enabling RCE/DoS makes this a priority remediation item. This is not a high-CVSS-low-risk scenario; exploitation is highly probable and impact severe.

An attacker with valid TOTOLINK X15 admin credentials (or obtained through initial compromise/weak default credentials) sends a specially crafted HTTP POST request to /boafrm/formIpQoS with an oversized 'mac' parameter containing a payload designed to overflow the buffer. The payload overwrites adjacent memory, potentially including function return addresses or heap metadata. This allows the attacker to: (1) execute arbitrary code with device privileges (RCE), (2) crash the device (DoS), or (3) exfiltrate sensitive configuration data. Given public POC availability, script kiddie-level attackers can execute this attack. Real-world attack chain: exploit weak default credentials or prior compromise → authenticate to admin interface → send buffer overflow payload via /boafrm/formIpQoS → achieve root code execution → establish persistence (modify firmware/install backdoor). The low Attack Complexity and network accessibility enable rapid, automated exploitation across exposed TOTOLINK X15 devices on the internet.