X15 Firmware EUVD-2025-17105

CVSS 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U indicates high severity: network-accessible, low attack complexity, but requires low-privilege authentication (login to router admin panel). The PR:L requirement meaningfully reduces real-world attack surface—an attacker must first gain router access via credential compromise, default credentials, or prior vulnerability. However, multiple factors elevate practical risk: (1) Public exploit availability dramatically increases exploitation likelihood; (2) Consumer routers typically have weak credential hygiene (default admin/admin, admin/12345); (3) No user interaction required (UI:N); (4) CVSS impact ratings are at maximum (C:H/I:H/A:H = full RCE). EPSS score would likely be elevated (>0.85) given public POC and exploitability. KEV status indicates coordinated disclosure failure or vendor lag. The authentication requirement prevents unauthenticated remote exploitation but does not prevent attack from compromised user accounts, compromised LAN clients, or physical access scenarios. Real-world risk is HIGH for environments where router admin credentials are weak or shared.

An attacker with access to the router's admin panel (via default credentials, credential stuffing, or phishing of router password) authenticates to the web interface. The attacker crafts a POST request to /boafrm/formStats with an oversized 'submit-url' parameter (e.g., 5000+ bytes of shellcode or ROP gadgets). The vulnerable HTTP handler copies this unsanitized input into a fixed-size stack buffer without bounds checking, triggering a buffer overflow. The overflow overwrites the return address or function pointer, redirecting execution to attacker-controlled code. Result: arbitrary code execution on the router with root privileges, enabling firmware modification, botnet installation, traffic interception, or lateral network attacks. Attack is fully automatable; POC exploit code is publicly available, reducing barrier to exploitation. Alternatively, an attacker on the local network (compromised device, guest network) could attempt to exploit if default credentials remain unchanged, increasing practical attack surface.