EUVD-2025-18480Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents HIGH real-world risk despite requiring authenticated access (PR:L). Multiple risk indicators converge: (1) CVSS 8.8 reflects high severity with network accessibility, low attack complexity, and complete confidentiality/integrity/availability impact; (2) Public exploit disclosure eliminates the weaponization barrier; (3) CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates the attack requires only low-privileged authenticated access—achievable if default credentials exist or through credential compromise; (4) CWE-119 buffer overflows reliably lead to RCE in embedded devices; (5) Router appliances are frequently left on networks with persistent access. SSVC framework assessment: Exploitation=Active (POC exists), Automatable=Yes (no user interaction required), Technical Impact=Total (complete system compromise). The authentication requirement moderates risk slightly, but the public exploit code and router context suggest this is being actively leveraged. Priority: CRITICAL for TOTOLINK X15 users; recommend immediate patching or network isolation. |
| Exploit ScenarioDerived | An attacker with valid router credentials (obtained via phishing, weak defaults, or credential stuffing) sends a malicious HTTP POST request to http://<router-ip>/boafrm/formTmultiAP with a 'submit-url' parameter containing a payload exceeding the buffer size (e.g., 1000+ bytes of shell code + ROP gadget chain). The buffer overflow overwrites adjacent stack memory, corrupting the return address and diverting execution to attacker-controlled code. This achieves arbitrary code execution with the privileges of the web server process (often root on embedded routers). The attacker can then: install a persistent backdoor, exfiltrate network traffic, modify DNS settings, or launch attacks on LAN devices. The low attack complexity (AC:L) and absence of user interaction (UI:N) means exploitation succeeds reliably. Public POC code accelerates widespread exploitation. Attack timeline: minutes from initial access to full system compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical buffer overflow vulnerability in TOTOLINK X15 firmware (version 1.0.0-B20230714.1105) affecting the HTTP POST request handler in the /boafrm/formTmultiAP endpoint. An authenticated remote attacker can exploit this vulnerability by manipulating the 'submit-url' parameter to achieve buffer overflow, resulting in complete compromise of the router (data theft, modification, and denial of service). Public exploit code is available and the vulnerability meets the profile of actively exploitable threats.
RemediationAI
Firmware Update: Contact TOTOLINK support or check their official support portal for a patched firmware version newer than 1.0.0-B20230714.1105. Apply the update immediately through the router's web interface or recovery procedure.; priority: CRITICAL Temporary Mitigation (if patch unavailable): Restrict network access to the router's web management interface: (1) Disable remote management if enabled; (2) Use firewall rules to limit HTTP/HTTPS access to trusted IPs only; (3) Change default administrative credentials to strong, unique passwords; (4) Isolate the router on a segregated management network.; priority: HIGH Detection: Monitor for HTTP POST requests to /boafrm/formTmultiAP with unusually long 'submit-url' parameters (>256 bytes typical); enable router logging if available.; priority: MEDIUM Workaround: If multi-AP functionality is not required, disable it through the router's configuration interface to reduce attack surface.; priority: MEDIUM
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the HTTP POST request handler component of TOTOLINK's web management interface, specifically in the /boafrm/formTmultiAP endpoint. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow flaw where user-supplied input via the 'submit-url' parameter is not properly validated for length before being written to a fixed-size buffer. This affects TOTOLINK X15 routers running firmware version 1.0.0-B20230714.1105. The HTTP POST handler processes multi-AP (access point) configuration requests, and the unsanitized parameter creates an arbitrary memory write primitive. CPE identification: vendor:totolink, product:x15, version:1.0.0-b20230714.1105. The vulnerability involves stack or heap-based buffer overflow depending on buffer allocation strategy used in the formTmultiAP handler.
Know when X15 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formTmultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A critical remote code execution vulnerability affects TOTOLIK X15 routers with a public exploit available and no patch currently available. Organizations using this device are at immediate risk of unauthorized access, data theft, and network compromise without remediation.
Deploy Web Application Firewall (WAF) rules to sanitize and block buffer overflow attempts in the submit-url parameter; implement network access controls restricting HTTP POST requests to this endpoint to trusted sources only; disable the multiAP feature if not operationally required; place affected devices behind VPN or restricted network segments; enable enhanced logging and anomaly detection on device traffic; monitor for exploitation attempts and IOCs; schedule immediate vendor communication for patch timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in X15 Firmware
View allA buffer overflow vulnerability (CVSS 8.8). Risk factors: public PoC available.
Critical remote buffer overflow vulnerability in TOTOLINK X15 router firmware (version 1.0.0-B20230714.1105) affecting t
A buffer overflow vulnerability in A vulnerability (CVSS 8.8). Risk factors: public PoC available.
A vulnerability classified as critical has been found in TOTOLINK X15 up to 1.0.0-B20230714.1105. Affected is an unknown
CVE-2025-6399 is a critical buffer overflow vulnerability in TOTOLINK X15 router (firmware version 1.0.0-B20230714.1105)
CVE-2025-6402 is a critical buffer overflow vulnerability in TOTOLINK X15 firmware version 1.0.0-B20230714.1105 affectin
A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this
Critical buffer overflow vulnerability in TOTOLINK X15 firmware version 1.0.0-B20230714.1105 affecting the HTTP POST req
Critical buffer overflow vulnerability in TOTOLINK X15 router firmware version 1.0.0-B20230714.1105, affecting the HTTP
Critical buffer overflow vulnerability in TOTOLINK X15 firmware version 1.0.0-B20230714.1105 affecting the HTTP POST req
Critical buffer overflow vulnerability in TOTOLINK X15 1.0.0-B20230714.1105 affecting the DMZ configuration HTTP POST ha
Critical buffer overflow vulnerability in TOTOLINK X15 router firmware (version 1.0.0-B20230714.1105) affecting the HTTP
Exploit-DB