What is the CVSS score of CVE-2025-6143?

CVE-2025-6143 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2025-6143?

Yes, a public proof-of-concept exploit is available for CVE-2025-6143. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-6143?

Within 24 hours: Inventory all TOTOLINK EX1200T devices in your environment and isolate affected units from critical network segments if possible. Within 7 days: Implement network access controls (WAF rules, IP whitelisting) to restrict access to the vulnerable HTTP endpoint (/boafrm/formNtp) and consider disabling NTP configuration if not essential. Within 30 days: Replace affected devices with patched models or alternative vendors, as no vendor patch is currently available and the vulnerability is actively exploited.

Ex1200t Firmware CVE-2025-6143

EUVD-2025-18425 HIGH

Buffer Overflow (CWE-119)

2025-06-16 cna@vuldb.com

RCE Buffer Overflow TP-Link Ex1200t Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-119 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	This vulnerability presents HIGH real-world risk despite requiring authenticated access. Critical risk factors: (1) CVSS 8.8 reflects high severity with network-based attack vector (AV:N), low attack complexity (AC:L), high impact across all three security properties (C:H/I:H/A:H); (2) Public exploit availability significantly increases exploitation probability and lowers the barrier for threat actors; (3) Requires only low privilege level (PR:L), meaning any authenticated user can trigger the vulnerability; (4) The router's role as a network perimeter device makes compromise particularly valuable for lateral movement and network-wide attacks. Mitigation factor: The PR:L requirement means external attackers must first obtain valid credentials (via weak default passwords, credential reuse, or prior compromise), which is common in IoT device deployments but not automatic. SSVC signals: exploitation is public (active), likely automatable, and technical impact is complete system takeover. This is a legitimate priority vulnerability, not a false positive.
Exploit ScenarioDerived	An attacker with valid router credentials (obtained via weak default password 'admin:admin' common to TOTOLINK devices, or credential stuffing) authenticates to the router's web interface. The attacker sends a specially crafted HTTP POST request to http://[router-ip]/boafrm/formNtp with an oversized submit-url parameter containing shellcode or ROP gadgets. The lack of input validation causes a buffer overflow, overwriting the return address on the stack. Upon function return, execution jumps to attacker-controlled code running with root privileges, enabling complete device compromise including firmware modification, traffic interception, or use as a pivot point for network attacks. Given public exploit availability, automated scanning and exploitation of vulnerable TOTOLINK devices is likely occurring or imminent.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

Critical buffer overflow vulnerability in TOTOLINK EX1200T router firmware (version 4.1.2cu.5232_B20210713) affecting the NTP configuration handler. An authenticated attacker can remotely exploit this vulnerability via HTTP POST requests to the /boafrm/formNtp endpoint by manipulating the submit-url parameter, achieving remote code execution with complete system compromise (confidentiality, integrity, and availability). A public exploit has been disclosed and the vulnerability may be actively exploited in the wild.

RemediationAI

Primary: Update firmware to a patched version released by TOTOLINK addressing CVE-2025-6143. Contact TOTOLINK support or check the official product support page at totolink.net for available firmware updates. If a patch is not available, implement network-level mitigations: (1) Restrict HTTP administrative access to the router via firewall rules, limiting access to trusted IP addresses/networks; (2) Enforce strong, unique credentials for router administrative accounts to prevent unauthorized authentication; (3) Disable remote management features if not required; (4) Isolate the router on a separate administrative VLAN with restricted access. Monitor for suspicious HTTP POST requests to /boafrm/formNtp with unusually long submit-url parameters.

Affected VersionsENISA

EX1200T 4.1.2cu.5232_B20210713

Affected Packages

euvd ex1200t no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the HTTP POST request handler component that processes NTP (Network Time Protocol) configuration parameters. The affected file /boafrm/formNtp fails to properly validate the length of the 'submit-url' argument before copying it into a fixed-size buffer, resulting in a classic stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). The TOTOLINK EX1200T is a wireless router that uses embedded HTTP services for administrative configuration. The vulnerability is present in firmware version 4.1.2cu.5232_B20210713 and potentially affects CPE: cpe:2.3:o:totolink:ex1200t_firmware:4.1.2cu.5232_b20210713:*:*:*:*:*:*:*. The buffer overflow allows attackers to overwrite the stack, potentially redirecting program execution to attacker-controlled code.

Know when Ex1200t Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Jun 23, 2025 - 19:29 vuln.today

Public exploit code

CVE Published

Jun 16, 2025 - 23:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formNtp of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Executive ViewAI

Why It Matters

A remote code execution vulnerability affecting TOTOLIK EX1200T routers (model 4.1.2cu.5232_B20210713) has been publicly disclosed with working exploits available. Organizations using this router model face immediate risk of unauthorized access and network compromise, as attackers can exploit the flaw without authentication or user interaction.

Business Impact: Severe

Compensating Controls

Implement WAF rules to block POST requests to /boafrm/formNtp with submit-url parameters; restrict HTTP/HTTPS access to the management interface via network segmentation (VLANs, firewall rules) limiting connectivity to authorized administrators only; disable remote management if not operationally required; monitor affected devices for suspicious activity patterns; consider replacing the device with alternative hardware pending vendor patch availability.

Threat Intelligence Overview

EPSS Score

0.4%

Top 39% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.