X15 Firmware EUVD-2025-17322

Despite the critical 8.8 CVSS v3.1 score, this vulnerability exhibits mixed real-world risk signals. Positive risk indicators: CVSS vector shows network-accessible attack surface (AV:N), low attack complexity (AC:L), and severe impact (High C/I/A). The disclosure of functional exploit code substantially increases exploitation probability. Mitigating factors: exploitation requires authentication (PR:L), reducing casual opportunistic attacks but remaining concerning for credential-compromised scenarios or local network attackers. The vulnerability likely has high EPSS score given public POC availability and network-accessible attack vector. This is a HIGH-PRIORITY vulnerability due to: (1) public exploit availability, (2) authentication-bypass potential through credential compromise or default credentials common in IoT devices, (3) firmware-level execution allowing complete device compromise. Real-world risk is substantial for organizations with TOTOLINK X15 devices in production.

An attacker with network access and valid credentials (obtained through credential compromise, default credentials, or local network access) sends a crafted HTTP POST request to http://[router-ip]/boafrm/formWsc with an oversized submit-url parameter containing shellcode. The buffer overflow overwrites adjacent memory regions, including potential return pointers or function tables. If successful, the attacker achieves arbitrary code execution on the router with device-level privileges, enabling complete device takeover, lateral network movement, traffic interception, or use as a botnet node. Given public POC availability, automated scanning and exploitation is feasible. Attack complexity is low (AC:L), making this exploitable by moderately skilled attackers once they gain initial authentication or discover exposed devices with weak credentials.