EUVD-2025-18453Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents very high real-world risk across multiple assessment frameworks. CVSS 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates: (1) Network-accessible attack with no special conditions (AV:N/AC:L); (2) requires low privilege (PR:L—authenticated access, common for router admin panels); (3) no user interaction needed (UI:N); (4) achieves full system compromise (C:H/I:H/A:H—all three impact aspects at maximum). Critically, public POC availability (as stated in CVE description) and the automated nature of buffer overflow exploitation through HTTP POST dramatically increase EPSS probability above baseline CVSS. The authentication requirement (PR:L) is a minor control, but many TOTOLINK devices have weak default credentials or allow unauthenticated configuration. The lack of memory protections (typical in embedded firmware) and remote accessibility make this a primary-tier priority. This is NOT a low-real-risk-high-CVSS case; it is genuinely critical. |
| Exploit ScenarioDerived | An attacker with valid router admin credentials (obtained via phishing, credential stuffing, or default credentials like admin/admin) sends a crafted HTTP POST request to http://<router-ip>/boafrm/formMultiAP with an oversized or specially crafted payload in the 'submit-url' parameter. Example: POST /boafrm/formMultiAP HTTP/1.1 | Host: 192.168.0.1 | Content-Type: application/x-www-form-urlencoded | submit-url=[1024+ byte payload with ROP gadgets or shellcode]. The buffer overflow overwrites adjacent stack memory, potentially corrupting return addresses or function pointers. In embedded devices without ASLR/DEP, the attacker achieves arbitrary code execution with root privileges (router runs web server as root). Consequences: data exfiltration (captured traffic), DNS hijacking, firmware modification for persistence, botnet recruitment, or denial of service. POC availability (disclosed) means automated exploitation tools exist; risk is immediate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical remote buffer overflow vulnerability in TOTOLINK X15 router firmware (version 1.0.0-B20230714.1105) affecting the HTTP POST request handler for the /boafrm/formMultiAP endpoint. An authenticated attacker can exploit improper input validation on the 'submit-url' parameter to achieve complete system compromise including confidentiality, integrity, and availability breaches. A public proof-of-concept exists and the vulnerability is actively exploitable without user interaction.
RemediationAI
No vendor patch details are provided in the CVE description; however, standard remediation approaches include: (1) Immediate: Restrict network access to the HTTP administrative interface using firewall rules (block WAN access to port 80/443 if possible); (2) Temporary mitigation: Change default credentials and disable remote management if not required; (3) Permanent: Monitor TOTOLINK security advisories for a patched firmware version (likely 1.0.0-B20230714.1106 or later). Contact TOTOLINK technical support (support@totolink.net) for patch availability. Until patched, do NOT expose the router's web interface to untrusted networks. Consider network segmentation to isolate administrative access. Firmware update procedures: access router admin panel → System Settings → Firmware Upgrade → select patched binary (when available).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) buffer overflow in embedded router firmware. The affected component is the HTTP POST request handler—likely implemented in C/C++ within the router's web administrative interface. The /boafrm/formMultiAP endpoint processes multi-AP configuration requests, and the 'submit-url' parameter lacks proper bounds checking before being written to a fixed-size buffer. This is typical of legacy embedded device code where memory constraints were less flexible but input validation was often overlooked. The CPE identifier would be: cpe:2.3:o:totolink:x15_firmware:1.0.0-b20230714.1105:*:*:*:*:*:*:* (or similar firmware variant). TOTOLINK devices use proprietary web interfaces typically running on lightweight HTTP servers (often Boa or similar), which have historically been susceptible to memory safety issues.
Know when X15 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A publicly disclosed remote code execution vulnerability affects TOTOLIK X15 routers with no available patch, allowing unauthenticated attackers to compromise affected devices. Organizations using this model face immediate risk of network infiltration, data theft, and lateral movement into connected systems.
Deploy Web Application Firewall (WAF) rules to block HTTP POST requests to /boafrm/formMultiAP endpoint; implement network segmentation isolating affected routers to separate VLAN with restricted egress; disable remote management features if supported; monitor for exploitation attempts via IDS/IPS; consider disabling the multi-AP functionality if not operationally required; implement rate limiting on the vulnerable endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in X15 Firmware
View allA buffer overflow vulnerability (CVSS 8.8). Risk factors: public PoC available.
Critical buffer overflow vulnerability in TOTOLINK X15 firmware (version 1.0.0-B20230714.1105) affecting the HTTP POST r
A buffer overflow vulnerability in A vulnerability (CVSS 8.8). Risk factors: public PoC available.
A vulnerability classified as critical has been found in TOTOLINK X15 up to 1.0.0-B20230714.1105. Affected is an unknown
CVE-2025-6399 is a critical buffer overflow vulnerability in TOTOLINK X15 router (firmware version 1.0.0-B20230714.1105)
CVE-2025-6402 is a critical buffer overflow vulnerability in TOTOLINK X15 firmware version 1.0.0-B20230714.1105 affectin
A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this
Critical buffer overflow vulnerability in TOTOLINK X15 firmware version 1.0.0-B20230714.1105 affecting the HTTP POST req
Critical buffer overflow vulnerability in TOTOLINK X15 router firmware version 1.0.0-B20230714.1105, affecting the HTTP
Critical buffer overflow vulnerability in TOTOLINK X15 firmware version 1.0.0-B20230714.1105 affecting the HTTP POST req
Critical buffer overflow vulnerability in TOTOLINK X15 1.0.0-B20230714.1105 affecting the DMZ configuration HTTP POST ha
Critical buffer overflow vulnerability in TOTOLINK X15 router firmware (version 1.0.0-B20230714.1105) affecting the HTTP
Exploit-DB