Ex1200t Firmware CVE-2025-6145

This vulnerability presents CRITICAL real-world risk despite being from 2021 vintage. CVSS 8.8 reflects high severity (High confidentiality/integrity/authenticity impact, no scope change), and the vector AV:N/AC:L/PR:L/UI:N indicates remote, unauthenticated attack path with low complexity—however, PR:L (requires low privilege/authentication) is a partial mitigating factor. The presence of publicly disclosed POC code significantly elevates exploitation probability; EPSS would likely be elevated (estimated 0.85+) due to public availability and automatable nature of buffer overflow exploitation. KEV candidacy is high given public POC and active threat landscape. Risk is substantially higher than typical 8.8-CVSS issues because: (1) TOTOLINK devices are consumer/SMB endpoints often exposed to internet, (2) authentication bypass may exist in same codebase, (3) no modern DEP/ASLR protections on embedded devices, (4) long time since disclosure (2021) means unpatched devices remain in production. SSVC assessment: Exploitation=PoC Available, Automatable=True, Technical Impact=Total; this rates as SCHEDULED/DEFER at minimum, IMMEDIATE for exposed devices.

An attacker with network access to the TOTOLINK EX1200T management interface (typically 192.168.0.1:80 or similar) authenticates with default or weak credentials (common in consumer routers). The attacker sends a crafted HTTP POST request to /boafrm/formSysLog with a maliciously oversized 'submit-url' parameter (e.g., 5000+ bytes) containing shellcode or ROP gadgets. The buffer overflow overwrites the function return address or heap metadata, redirecting execution to attacker-controlled code. With no DEP/ASLR, shellcode executes with device root privileges, allowing: installation of persistent backdoors, traffic interception, pivot to internal network, or denial of service. Alternatively, if authentication bypass exists in the same HTTP handler, unauthenticated remote exploitation is feasible. Public POC would demonstrate the exact payload construction and parameter injection technique, significantly lowering the barrier to exploitation.