EUVD-2025-18424Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 8.8 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates high severity with moderate real-world friction: while network-accessible (AV:N) and low complexity (AC:L), it requires low privilege authentication (PR:L), reducing opportunistic attacks but maintaining significant risk for compromised or insider accounts. The public disclosure of exploit code combined with CVSS 8.8 rating and confirmed vulnerable firmware versions in active deployment suggest EPSS score likely exceeds 0.90. KEV status appears probable given public POC availability. From SSVC perspective: exploitation is active (public POC), highly automatable (HTTP POST parameter fuzzing), and technical impact is complete system compromise (confidentiality+integrity+availability). This represents a genuine critical priority—not a CVSS-inflation false alarm. Embedded device users cannot easily patch, making this particularly dangerous for IoT/SMB networks. |
| Exploit ScenarioDerived | An attacker with valid (low-privilege) credentials to the TOTOLINK EX1200T web management interface crafts a malicious HTTP POST request to /boafrm/formSysCmd with an oversized 'submit-url' parameter containing shellcode. The parameter value exceeds the allocated buffer size, overwriting adjacent memory structures including return addresses or function pointers. Upon processing, the overflow is triggered without triggering modern protections (ASLR/DEP may be absent or bypassable in this firmware). The attacker gains arbitrary code execution with router privileges, enabling them to: (1) create persistent backdoors, (2) redirect traffic/perform MITM attacks, (3) pivot into the local network, (4) exfiltrate sensitive data. Given public POC availability, automated scanning/exploitation tools likely exist. Attack complexity is low—the exploit is reliably triggerable via standard HTTP clients. Realistic scenario: network admin account is compromised or attacker is an insider; they upload malicious payload via the vulnerable endpoint, gaining full device control within seconds. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical buffer overflow vulnerability in TOTOLINK EX1200T wireless router (firmware version 4.1.2cu.5232_B20210713) affecting the HTTP POST request handler at endpoint /boafrm/formSysCmd. An authenticated remote attacker can exploit this vulnerability by manipulating the 'submit-url' parameter to achieve buffer overflow, resulting in complete system compromise including confidentiality, integrity, and availability breaches. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exists in the HTTP POST request handler component of the TOTOLINK EX1200T router's web management interface. The affected endpoint /boafrm/formSysCmd processes user-supplied input via the 'submit-url' parameter without proper bounds checking, triggering CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The router firmware 4.1.2cu.5232_B20210713 contains insufficient input validation in the form submission handler, allowing attackers to write beyond allocated buffer boundaries. This is a classic buffer overflow vulnerability in embedded device firmware where legacy C-based code often lacks modern memory safety protections. The vulnerability affects CPE: cpe:2.3:o:totolink:ex1200t_firmware:4.1.2cu.5232_b20210713:*:*:*:*:*:*:*
Know when Ex1200t Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formSysCmd of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A critical remote code execution vulnerability affecting TOTOLINK EX1200T routers has been publicly disclosed with working exploits available. Organizations using this device model are at immediate risk of unauthorized access and network compromise without vendor remediation.
Within 24 hours: Identify all TOTOLIK EX1200T 4.1.2cu.5232_B20210713 devices on your network and isolate them from critical systems if possible; enable enhanced monitoring for exploitation attempts. Within 7 days: Contact TOTOLINK for patch availability and timeline; implement network segmentation to restrict access to affected devices; configure firewall rules to block external HTTP POST requests to /boafrm/formSysCmd. Within 30 days: Deploy patches immediately upon release; if no patch materializes, evaluate device replacement or decommissioning.
Implement Web Application Firewall (WAF) rules to block POST requests containing suspicious submit-url parameters to /boafrm/formSysCmd endpoint; restrict HTTP/HTTPS access to affected devices to trusted IP ranges only; disable remote administration features if operationally feasible; segment affected devices to isolated VLANs with egress filtering; deploy intrusion detection rules targeting CVE-2025-6144 exploitation patterns; consider device replacement if patch remains unavailable beyond 30 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Ex1200t Firmware
View allTOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code
TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the s
TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the s
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the
Buffer overflow in TOTOLINK EX1200T via setLanguageCfg. EPSS 0.52%. PoC available.
CVE-2025-6393 is a critical buffer overflow vulnerability in the HTTP POST request handler of TOTOLINK routers affecting
Critical buffer overflow vulnerability in TOTOLINK EX1200T routers (firmware versions up to 4.1.2cu.5232_B20210713) affe
A buffer overflow vulnerability (CVSS 8.8). Risk factors: public PoC available.
A buffer overflow vulnerability in A vulnerability (CVSS 8.8). Risk factors: public PoC available.
Critical buffer overflow vulnerability in TOTOLINK EX1200T wireless router (firmware version 4.1.2cu.5232_B20210713) aff
A buffer overflow vulnerability (CVSS 8.8). Risk factors: public PoC available.
Exploit-DB