What is the CVSS score of CVE-2025-5909?

CVE-2025-5909 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2025-5909?

Yes, a public proof-of-concept exploit is available for CVE-2025-5909. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-5909?

Within 24 hours: Identify and inventory all TOTOLIK EX1200T devices in your network and isolate affected units from critical systems if possible. Within 7 days: Contact TOTOLINK support to determine if a patched firmware version is available for your specific device configuration; if available, create a patching plan with change management approval. Within 30 days: Implement network segmentation to restrict access to affected devices, deploy WAF rules blocking POST requests to /boafrm/formReflashClientTbl, and establish monitoring for suspicious device behavior; begin replacement planning if no vendor patch materializes.

Ex1200t Firmware CVE-2025-5909

EUVD-2025-17617 HIGH

Buffer Overflow (CWE-119)

2025-06-10 cna@vuldb.com

Buffer Overflow TP-Link RCE Ex1200t Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17617

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

PoC Detected

Jun 16, 2025 - 17:14 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 02:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formReflashClientTbl of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical buffer overflow vulnerability in TOTOLINK EX1200T wireless routers (up to firmware version 4.1.2cu.5232_B20210713) affecting the HTTP POST request handler for the /boafrm/formReflashClientTbl endpoint. An authenticated attacker can remotely exploit this vulnerability to achieve complete system compromise including confidentiality, integrity, and availability violations. Public exploit code has been disclosed, making this an active threat with demonstrated proof-of-concept availability.

Technical ContextAI

The vulnerability exists in the HTTP POST request handler component of TOTOLINK's web management interface, specifically within the formReflashClientTbl form processing function. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating a classic stack or heap buffer overflow condition. The vulnerability occurs when user-supplied input from HTTP POST requests is processed without proper bounds checking before being written to a fixed-size buffer. TOTOLINK EX1200T (CPE: cpe:2.3:o:totolink:ex1200t_firmware:*:*:*:*:*:*:*:* up to version 4.1.2cu.5232_B20210713) devices using this vulnerable firmware version are affected. The affected component suggests the vulnerability is in the device's web administration interface, likely used for firmware updates or client management operations.

RemediationAI

action: Firmware Update; details: Update TOTOLINK EX1200T firmware to version newer than 4.1.2cu.5232_B20210713. Contact TOTOLINK support or check device management interface for available firmware updates. Verify update authenticity through official TOTOLINK channels.; priority: CRITICAL - Apply immediately
action: Access Control Mitigation; details: If firmware update is unavailable, implement network-level mitigations: (1) Restrict access to the device's web management interface (port 80/443) using firewall rules to trusted administrative networks only, (2) Disable remote management if enabled, (3) Change default credentials to strong, unique passwords to reduce authentication bypass risk.; priority: HIGH - Implement pending patch availability
action: Monitoring; details: Monitor device logs for POST requests to /boafrm/formReflashClientTbl with unusually large payloads or malformed input. Configure IDS/IPS signatures to detect buffer overflow attack patterns against this endpoint.; priority: MEDIUM - Implement for detection coverage
action: Device Assessment; details: Audit network inventory for TOTOLINK EX1200T devices and determine firmware versions in use. Prioritize patching for devices exposed to untrusted networks or with multiple user accounts.; priority: MEDIUM - Scope the exposure