X15 Firmware CVE-2025-6399

This vulnerability presents genuine, high-priority risk across multiple assessment dimensions: (1) CVSS 3.1 score of 8.8 (High) with network accessibility (AV:N), low attack complexity (AC:L), requiring low privileges (PR:L), and complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) confirms severe impact potential; (2) The exploitation status is critical—a public proof-of-concept exists, significantly increasing EPSS probability well above baseline for similar vulnerabilities; (3) The vulnerability requires only low privilege (authenticated user access), which is often achievable through default credentials, weak passwords, or cross-site request forgery; (4) Attack automation is feasible given the straightforward buffer overflow mechanism and public exploit availability; (5) SSVC framing shows: exploitation=active (POC public), automatable=yes (memory corruption), technical_impact=total (RCE enables full system control). However, the PR:L requirement provides a minor friction point—complete unauthenticated attacks would require secondary exploitation or credential compromise. For IoT/router environments where default credentials persist, this is a minor barrier. Real-world risk is very high; this is not a low-risk high-CVSS edge case.

An attacker with low-privilege access to the TOTOLINK X15 router (e.g., a guest user account, or via CSRF from an internal network host) crafts a malicious HTTP POST request to /boafrm/formIPv6Addr with an oversized submit-url parameter (e.g., a string of 2000+ characters). This payload exceeds the expected buffer size, overflowing into adjacent stack memory. By carefully constructing the payload with crafted binary data, the attacker overwrites the return address of the handler function with a pointer to shellcode injected earlier in the buffer or present elsewhere in memory. When the vulnerable function returns, execution jumps to the attacker's code, granting remote code execution with the privileges of the HTTP daemon (typically root/administrator on embedded systems). From this foothold, the attacker can: replace firmware, harvest credentials, establish persistent backdoors, pivot to internal networks, or launch DDoS attacks. The public POC tool automates this process, lowering the barrier to exploitation significantly. On networks where TOTOLINK routers run with default or weak administrative credentials, an unauthenticated attacker could first compromise credentials, then leverage this CVE for full device takeover.