What is the CVSS score of EUVD-2025-17325?

EUVD-2025-17325 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of X15 Firmware are affected by EUVD-2025-17325?

TOTOLIK X15 routers are vulnerable to remote code execution through a buffer overflow in the wireless configuration interface, affecting any organization using this device model.

How to fix or mitigate EUVD-2025-17325?

Within 24 hours: Identify and inventory all TOTOLINK X15 devices in production and isolate them to restricted network segments if possible. Within 7 days: Implement network access controls to restrict HTTP POST requests to the /boafrm/formWirelessTbl endpoint, disable remote administration if enabled, and deploy WAF rules to block malicious submit-url payloads. Within 30 days: Evaluate replacement with patched router firmware versions or alternative vendors; monitor for vendor patch availability and apply immediately upon release.

X15 Firmware EUVD-2025-17325

| CVE-2025-5785 HIGH

Buffer Overflow (CWE-119)

2025-06-06 cna@vuldb.com

Buffer Overflow X15 Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17325

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 16:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This issue affects some unknown processing of the file /boafrm/formWirelessTbl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical buffer overflow vulnerability in TOTOLINK X15 router firmware (version 1.0.0-B20230714.1105) affecting the HTTP POST request handler for the /boafrm/formWirelessTbl endpoint. An authenticated attacker can exploit the 'submit-url' parameter to trigger a buffer overflow, achieving remote code execution with full system compromise (confidentiality, integrity, and availability impact). The vulnerability has been publicly disclosed with proof-of-concept code available, presenting immediate exploitation risk in production environments.

Technical ContextAI

The vulnerability exists in the TOTOLINK X15 router's web-based management interface, specifically within the HTTP POST request handler that processes wireless table configuration requests. The flaw is rooted in CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow vulnerability class. The /boafrm/formWirelessTbl endpoint accepts user-supplied input via the 'submit-url' POST parameter without proper bounds checking or input validation. This parameter is likely used to construct URLs or file paths for wireless configuration processing, and the lack of length validation allows an attacker to write data beyond allocated buffer boundaries. The affected component is part of the router's embedded web server (likely Boa or similar lightweight HTTP daemon common in SOHO routers), which runs with elevated privileges necessary to modify network configuration. The vulnerability affects CPE: cpe:2.3:o:totolink:x15_firmware:1.0.0-b20230714.1105:*:*:*:*:*:*:*

RemediationAI

(1) IMMEDIATE: Update router firmware to the latest available version from TOTOLINK official channels (typically accessible via router web interface under System Settings > Firmware Upgrade or via https://www.totolink.net/home/customercare/support.html); verify the update addresses CVE-2025-5785 in release notes. (2) TEMPORARY MITIGATION (pending patch): Restrict access to router management interface by disabling remote management (disable HTTP/HTTPS access from WAN), modify default HTTP management port, and implement strong authentication credentials (change default admin/admin credentials to unique, complex password). (3) NETWORK-LEVEL: Implement firewall rules to restrict management port access (typically 80/443) to trusted administrative networks only; segment router management traffic from general network traffic. (4) MONITORING: Enable and review router access logs for suspicious POST requests to /boafrm/formWirelessTbl with unusual 'submit-url' parameter values. (5) CONTINGENCY: If patched firmware is unavailable or delayed, consider replacing the affected router with alternative models from trusted vendors with active security update programs.