X15 Firmware CVE-2025-6402

This vulnerability presents HIGH real-world risk despite authentication requirement. Risk signals analysis: (1) CVSS 8.8 reflects high severity with network vector and complete CIA impact; (2) Public POC availability dramatically increases exploitation likelihood—EPSS score would be elevated due to known exploitability; (3) KEV status unknown but POC disclosure indicates active/imminent exploitation potential; (4) Authentication requirement (PR:L) moderates attack surface compared to unauthenticated exploits; (5) Buffer overflow in memory-unsafe language (likely C) on embedded device firmware typically grants RCE with high reliability. SSVC framework assessment: exploitation=functional (POC public), automatable=yes (HTTP POST), technical-impact=total (RCE). This is NOT a high-CVSS-but-low-risk issue—the combination of public POC, firmware-level access, and complete system compromise makes this a genuine priority, particularly for Internet-facing router deployments.

An authenticated attacker (either legitimate user with compromised credentials or internal network attacker) crafts an HTTP POST request to http://[router-ip]/boafrm/formIpv6Setup with an oversized 'submit-url' parameter containing shellcode and ROP gadget chains. The buffer overflow overwrites a return address on the stack, redirecting execution to attacker-controlled code. The attacker achieves root-level code execution on the router, enabling: modification of firewall rules, DNS spoofing, session hijacking of connected users, exfiltration of network traffic, or use of the router as a botnet node. Because public POC exists, attackers can readily adapt it for mass exploitation of unpatched X15 devices without detailed reverse engineering. Attack complexity is low (AC:L)—no special conditions required beyond crafting the malicious POST request.