What is the CVSS score of CVE-2025-6145?

CVE-2025-6145 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Ex1200t Firmware are affected by CVE-2025-6145?

A remote code execution vulnerability affecting TOTOLINK EX1200T routers has been publicly disclosed with active exploit code available, creating immediate risk for any organization using this device…

Is there a public PoC exploit available for CVE-2025-6145?

Yes, a public proof-of-concept exploit is available for CVE-2025-6145. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-6145?

Within 24 hours: Inventory all TOTOLINK EX1200T devices on your network and isolate any running firmware version 4.1.2cu.5232_B20210713 from critical systems. Within 7 days: Contact TOTOLINK support for firmware updates or migrate affected routers to alternative vendor solutions if patches are not available. Within 30 days: Complete replacement or remediation of all vulnerable devices and implement network segmentation to limit router-based lateral movement.

Ex1200t Firmware CVE-2025-6145

EUVD-2025-18426 HIGH

Buffer Overflow (CWE-119)

2025-06-16 cna@vuldb.com

Buffer Overflow TP-Link RCE Ex1200t Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18426

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

PoC Detected

Jun 23, 2025 - 19:29 vuln.today

Public exploit code

CVE Published

Jun 16, 2025 - 23:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical buffer overflow vulnerability in TOTOLINK EX1200T wireless router (firmware version 4.1.2cu.5232_B20210713) affecting the /boafrm/formSysLog HTTP POST handler. An authenticated attacker can exploit improper input validation on the 'submit-url' parameter to achieve buffer overflow, leading to remote code execution with complete system compromise (confidentiality, integrity, and availability impact). Public exploit code is available, and the vulnerability affects a widely deployed consumer networking device.

Technical ContextAI

The vulnerability exists in the HTTP POST request handler of TOTOLINK's proprietary firmware, specifically in the /boafrm/formSysLog endpoint. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating a classic buffer overflow due to insufficient bounds checking. The 'submit-url' parameter is processed without proper length validation before being written to a stack or heap buffer, allowing an attacker to overflow adjacent memory. TOTOLINK EX1200T is a dual-band 802.11ac wireless router commonly deployed in SOHO and small enterprise environments. The firmware parsing and web interface are likely implemented in C/C++ without modern memory safety protections. CPE identifier: cpe:2.3:o:totolink:ex1200t_firmware:4.1.2cu.5232_b20210713:*:*:*:*:*:*:*

RemediationAI

Immediate actions: (1) Identify all TOTOLINK EX1200T devices in your environment, particularly those exposed to untrusted networks. (2) Check TOTOLINK's official website and support portal for firmware updates post-4.1.2cu.5232_B20210713. (3) If no patch is available from vendor (likely given age), consider: network segmentation to restrict unauthenticated access to the management interface (restrict /boafrm/* paths via firewall), disable remote management (WAN access to web UI), enforce strong authentication, or hardware replacement with a vendor offering active security support. (4) Monitor device logs and network traffic for exploitation attempts targeting /boafrm/formSysLog with large submit-url parameter values. (5) If patched firmware exists, validate integrity via checksum/signature before deployment. Workaround: Firewall rules blocking POST requests to /boafrm/formSysLog from untrusted sources; however, internal network attackers may still exploit if authenticated.