Ex1200t Firmware CVE-2025-5909

This vulnerability presents elevated real-world risk despite analysis complexity: CVSS 8.8 (Network-accessible, Low complexity, requires Low privileges) indicates strong exploitability from network attackers with basic authentication. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H demonstrates that any authenticated user (PR:L) can trigger complete system compromise without user interaction. Critical signals include: (1) Public POC availability dramatically increases practical exploitation probability, (2) The vulnerability affects residential/small-office networking equipment with potential for worm propagation given network position, (3) CWE-119 buffer overflows typically enable arbitrary code execution or denial of service, (4) Firmware versions affected are over 3 years old (2021 baseline), suggesting widespread legacy deployments remain unpatched. The requirement for low-privilege authentication (PR:L) is the primary limiting factor; however, many TOTOLINK devices have weak default credentials or credential exposure. This is not a high-CVSS-but-low-risk issue—it represents genuine critical infrastructure risk in deployed networks.

An attacker with valid credentials to a TOTOLINK EX1200T device (obtained through credential theft, default credentials, or social engineering) accesses the device's web administration panel. The attacker crafts a malicious HTTP POST request to the /boafrm/formReflashClientTbl endpoint containing a payload exceeding the buffer size allocated for client table data. This payload overwrites adjacent memory, allowing the attacker to: (1) Inject shellcode for arbitrary code execution, gaining root-level access to the router, (2) Modify router firmware or configuration to maintain persistence, (3) Use the compromised router as a network pivot point to attack internal LAN devices, or (4) Launch denial-of-service attacks against internet-facing services. Given public POC availability, this exploit can be automated and deployed at scale against vulnerable TOTOLINK devices, particularly in residential networks where security monitoring is minimal. The low attack complexity (AC:L) means the exploit does not require specific timing, vulnerability conditions, or extensive technical skill beyond using available POC code.