EUVD-2025-17349CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
A critical buffer overflow vulnerability exists in TOTOLINK EX1200T firmware version 4.1.2cu.5232_B20210713 in the HTTP POST request handler for the /boafrm/formPortFw endpoint. An authenticated attacker can exploit this by manipulating the 'service_type' parameter to achieve remote code execution with high impact to confidentiality, integrity, and availability (CVSS 8.8). Public exploits are available, making this an active threat.
Technical Context
The vulnerability resides in the TOTOLINK EX1200T wireless router's embedded HTTP server (boafrm component), specifically in the formPortFw request handler. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow flaw where user-supplied input to the 'service_type' parameter is not properly validated before being written to a fixed-size buffer. The HTTP POST request handler processes form data without adequate bounds checking, allowing an attacker to overflow the stack or heap and overwrite adjacent memory. This affects the CPE context: cpe:2.3:o:totolink:ex1200t_firmware:4.1.2cu.5232_b20210713:*:*:*:*:*:*:*
Affected Products
EX1200T (['4.1.2cu.5232_B20210713'])
Remediation
Check TOTOLINK's support page for EX1200T firmware updates released after July 2021. Apply the latest firmware version available.; priority: CRITICAL Workaround (Temporary): Restrict network access to the router's management interface (/boafrm/formPortFw) using firewall rules or access control lists. Limit HTTP POST requests to trusted IP addresses only.; priority: HIGH; note: This is a temporary measure only; patching is required. Mitigation: Disable remote management of the router if not required. Change default credentials immediately and use strong, unique passwords to reduce successful authentication exploitation.; priority: MEDIUM Vendor Advisory: Contact TOTOLINK support or check their security advisory page for official patches. Monitor TOTOLINK security bulletins for EX1200T firmware updates.; note: Specific patch version numbers should be verified against vendor releases.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today