Ex1200t Firmware CVE-2025-6128

This vulnerability presents significant real-world risk despite requiring authenticated access. CVSS 8.8 reflects high severity across all impact dimensions (C:H, I:H, A:H), but the attack vector requires PR:L (Low Privilege authentication). The critical factors elevating real-world risk are: (1) Public exploit disclosure makes weaponization trivial; (2) Buffer overflows in embedded systems frequently lead to reliable code execution; (3) Wireless router devices often have weak authentication defaults or credential compromise vectors; (4) The AC:L (Low Complexity) rating indicates no special conditions are required. However, the PR:L requirement reduces the attack surface compared to unauthenticated RCE. If EPSS data is available, expect scores >0.95 given public POC status. KEV inclusion (if present) would confirm active exploitation. This is NOT a 'high-CVSS-low-risk' issue—the authentication requirement is the primary control, but once bypassed (via default credentials, credential stuffing, or prior compromise), exploitation is highly reliable. Priority should be HIGH for any organization operating TOTOLINK EX1200T devices in production.

A threat actor gains low-privileged access to a TOTOLINK EX1200T administrative interface through credential compromise (e.g., default credentials 'admin/admin', phishing, or brute force against weak passwords). The attacker then crafts an HTTP POST request to /boafrm/formWirelessTbl with an oversized payload in the submit-url parameter, exceeding the buffer size allocated by the application. The buffer overflow overwrites adjacent memory, allowing the attacker to corrupt the stack or heap, redirect control flow to shellcode, and execute arbitrary commands with the privileges of the web server process (often root in embedded systems). This leads to full device compromise, enabling the attacker to modify wireless settings, inject malicious content, pivot to other network devices, or establish persistent backdoor access. Given public POC availability, this attack requires minimal sophistication: a simple curl command or automated exploit tool can trigger the vulnerability. Detection evasion is minimal due to the legitimate-looking POST request format.