Ex1200t Firmware EUVD-2025-17349

This vulnerability carries substantial real-world risk across multiple analytical frameworks: (1) CVSS 8.8 with AV:N (network-accessible), AC:L (low complexity), PR:L (low privilege requirement—requires authentication but not admin), and S:U/C:H/I:H/A:H indicates complete system compromise is possible. (2) Public exploit availability and KEV/CISA tracking status (exploit disclosed) elevate exploitation probability significantly. (3) EPSS scoring would likely be elevated given the combination of public POC, low attack complexity, and network accessibility despite the PR:L requirement. (4) SSVC analysis: exploitation=active (public POC), automatable=yes (HTTP POST is easily scriptable), technical_impact=total (code execution), yield a PATCH recommendation. (5) The authentication requirement (PR:L) moderates risk only slightly, as many routers have weak default credentials or users may be tricked into authenticated sessions. This is a legitimate high-priority vulnerability, not a false alarm, and should be patched immediately on affected devices.

An attacker on the network (or with network access to the router's IP) authenticates to the TOTOLINK EX1200T management interface using weak default credentials (e.g., admin/admin, common for routers). The attacker then crafts an HTTP POST request to /boafrm/formPortFw with a maliciously long 'service_type' parameter value exceeding buffer boundaries. This overflow overwrites stack memory, allowing the attacker to inject and execute arbitrary shellcode with root-level privileges on the router. The attacker could then pivot to the internal network, modify router configuration, install persistent backdoors, or use the router as a botnet node. The low attack complexity (AC:L) means the exploit is straightforward to automate and deploy at scale across vulnerable networks. Public POC availability means exploitation is likely occurring in the wild.