Ex1200t Firmware CVE-2025-5907

This vulnerability presents immediate, high real-world risk despite requiring authentication. CVSS score of 8.8 reflects high severity: network-accessible attack vector (AV:N), low complexity (AC:L), but requires low privilege (PR:L) authentication—a significant constraint. However, multiple risk signals elevate practical impact: (1) Public exploit disclosure and PoC availability accelerate weaponization; (2) TOTOLINK routers are widely deployed consumer/SMB devices with poor patch rates and extended unpatched lifecycles; (3) Buffer overflow vulnerabilities on embedded systems typically lead to RCE with minimal additional exploitation steps; (4) The firmware version date (2021) suggests this affects legacy devices still in production use. The authentication requirement (PR:L) reduces attack surface compared to unauthenticated RCE, but router administrative credentials are frequently weak, default, or compromised via other means. The high CIA impact (C:H/I:H/A:H) justifies critical severity. Exploitation probability is very high given public PoC availability and technical simplicity of buffer overflow attacks. This should be prioritized immediately for patching or replacement.

An attacker with network access gains router administrative credentials through credential stuffing (testing default credentials like admin/admin, common weak passwords), social engineering, or prior compromise of other systems sharing credentials. The attacker then authenticates to the router's web management interface (e.g., http://192.168.0.1) and crafts a malicious HTTP POST request to /boafrm/formFilter with an oversized filter parameter payload exceeding the buffer boundary (e.g., a multi-kilobyte string where only a few hundred bytes are expected). The buffer overflow overwrites adjacent memory regions containing function pointers or return addresses. Due to likely lack of ASLR/DEP protections on embedded TOTOLINK firmware, the attacker achieves stack-based code execution, executing arbitrary shell commands or uploading a backdoor. Once inside, the attacker gains full control of the router: modifying DNS settings for man-in-the-middle attacks, exfiltrating network traffic, pivoting to internal network devices, or using the router as a botnet node. Given the public PoC availability, script-kiddies and automated scanners now actively probe for vulnerable TOTOLINK devices, making this an immediate practical threat.