Ex1200t Firmware CVE-2025-6336

This is a HIGH PRIORITY vulnerability despite being authenticated. CVSS 8.8 (High) reflects: Network-accessible attack vector (AV:N), low complexity (AC:L), but requires low-privilege user login (PR:L), affecting confidentiality, integrity, and availability completely (C:H/I:H/A:H). The authentication requirement (PR:L) is significant—however, many TOTOLINK routers ship with default or weak credentials, and this applies to legitimate users with access. KEV/CISA inclusion status would indicate active exploitation in the wild; public POC availability (mentioned in description) substantially increases real-world risk. EPSS scoring would likely reflect 70-85% probability of exploitation given PoC availability and the embedded device context where patching is often delayed. SSVC analysis: Exploitation is PUBLIC, automatable (buffer overflow with known endpoint), technical impact is TOTAL (code execution). This is NOT a low-risk high-CVSS issue—the authentication gate is reasonable for a home router but does not significantly reduce exploitability given default credentials and internal network exposure.

An attacker with valid credentials to the TOTOLINK EX1200T web interface (obtained via default credentials, phishing, or network access) sends a crafted HTTP POST request to /boafrm/formTmultiAP with an oversized 'submit-url' parameter containing shellcode or ROP gadgets. The parameter overflows the fixed buffer, overwriting stack/heap metadata and the instruction pointer. The attacker achieves remote code execution within the router's privileged context, gaining ability to exfiltrate traffic, modify configurations, pivot to internal network, or render the device inoperable. Given public PoC availability, script kiddies can automate scanning for vulnerable TOTOLINK devices on public-facing networks (UPnP discovery) and exploit them. Home users with default credentials are at immediate risk; enterprise networks using these devices in remote office scenarios face significant compromise risk.