EUVD-2025-17322
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in TOTOLINK X15 firmware version 1.0.0-B20230714.1105 affecting the HTTP POST request handler at endpoint /boafrm/formWsc. An authenticated remote attacker can exploit this via a malicious 'submit-url' parameter to achieve remote code execution with high impact on confidentiality, integrity, and availability. Public exploit code is available, creating immediate risk for affected deployments.
Technical Context
This vulnerability exists in the HTTP POST request handler component of TOTOLINK X15 router firmware, specifically in the /boafrm/formWsc endpoint. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition. The submit-url parameter lacks proper input validation and bounds checking, allowing an attacker to write beyond allocated buffer boundaries. This is a memory safety issue in network-facing firmware code, likely written in C/C++ given the router firmware context. The vulnerability allows memory corruption that can lead to arbitrary code execution with device privileges. The affected product is TOTOLINK X15 with CPE identifier relevant to this specific router model and firmware version 1.0.0-B20230714.1105.
Affected Products
- vendor: TOTOLINK; product: X15; affected_versions: ['1.0.0-B20230714.1105']; vulnerability_component: HTTP POST Request Handler (/boafrm/formWsc); vulnerable_parameter: submit-url; attack_vector: Remote; authentication_required: True
Remediation
Contact TOTOLINK support or check the official TOTOLINK website for firmware updates addressing CVE-2025-5787. Firmware versions released after 1.0.0-B20230714.1105 should include buffer overflow fixes in the formWsc handler.; priority: Critical Workaround: Restrict network access to the router's web management interface (/boafrm/* endpoints) using firewall rules or network segmentation. Limit access to trusted administrative networks only.; priority: High Mitigation: Change default credentials on affected TOTOLINK X15 devices immediately. Implement strong, unique passwords to reduce exploitation risk even with authentication requirement.; priority: High Detection: Monitor network traffic to TOTOLINK X15 devices for suspicious POST requests to /boafrm/formWsc endpoint with unusually long submit-url parameters. Implement IDS/IPS signatures if available.; priority: Medium
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today