EUVD-2025-18413CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This affects an unknown part of the file /boafrm/formWirelessTbl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in TOTOLINK EX1200T wireless router (version 4.1.2cu.5232_B20210713) affecting the HTTP POST request handler for the /boafrm/formWirelessTbl endpoint. An authenticated attacker can exploit the submit-url parameter to achieve remote code execution with high confidentiality, integrity, and availability impact (CVSS 8.8). Public proof-of-concept code is available, and this vulnerability may be actively exploited in the wild.
Technical Context
The vulnerability exists in the HTTP POST request handler component of TOTOLINK's web-based firmware management interface. The affected endpoint /boafrm/formWirelessTbl processes wireless table configuration requests. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating insufficient input validation and buffer boundary checking on the 'submit-url' parameter. The vulnerable code fails to properly validate the length of user-supplied input before copying it into a fixed-size buffer, creating a classic stack or heap-based buffer overflow condition. This is a common pattern in embedded device firmware where input validation is often overlooked in internal administrative interfaces that are assumed to be protected by authentication.
Affected Products
Product: TOTOLINK EX1200T; Affected Version: 4.1.2cu.5232_B20210713; Device Type: Wireless Router (WiFi range extender based on product naming); CPE estimation: cpe:2.3:h:totolink:ex1200t:-:*:*:*:*:*:*:*. No explicit CPE string provided in description, but the specific firmware build (5232_B20210713) suggests TOTOLINK has released firmware updates. Other TOTOLINK router models with similar firmware architecture may be affected but have not been confirmed. No vendor advisory link provided in the CVE description.
Remediation
Immediate actions: (1) Check TOTOLINK security advisories for firmware updates addressing CVE-2025-6128 for EX1200T; (2) If available, upgrade to the latest patched firmware version beyond 4.1.2cu.5232_B20210713; (3) Enforce strong, unique administrative credentials on all TOTOLINK devices (change default credentials immediately); (4) Restrict access to the device management interface to trusted networks only using firewall rules or IP whitelisting; (5) Disable remote management features if not actively required; (6) Monitor device logs for suspicious POST requests to /boafrm/formWirelessTbl with unusual submit-url parameters; (7) Segment IoT/networking devices on separate VLANs to limit lateral movement if compromise occurs. Long-term: Consider replacing end-of-life TOTOLINK devices with actively maintained alternatives if patches are not released within 30 days.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today