X15 Firmware EUVD-2025-17350

Despite the 8.8 CVSS score indicating high severity, the actual exploitation risk is nuanced. Positive exploitation signals include: (1) CVSS vector shows low attack complexity (AC:L) and network-accessible attack vector (AV:N), (2) public exploit disclosure indicates proof-of-concept availability, (3) the vulnerability achieves complete system compromise (C:H, I:H, A:H). Mitigating factors include: (1) CVSS requires low-privilege authentication (PR:L), eliminating unauthenticated remote exploitation, (2) no KEV (Known Exploited Vulnerabilities) catalog listing is documented, suggesting limited real-world exploitation tracking, (3) the vulnerability targets a specific firmware version on a consumer router with potentially limited deployment. Per SSVC framework: exploitation is ACTIVE (public POC), impact is HIGH (RCE), and automatable (no user interaction required post-authentication). Priority remains elevated due to authentication requirement reducing blast radius—this is a real but contextually scoped risk primarily affecting environments where router admin credentials are compromised or weak.

An attacker with valid router administrative credentials (obtained through phishing, weak password, or prior compromise) authenticates to the TOTOLINK X15 web management interface. The attacker sends an HTTP POST request to /boafrm/formPortFw with an oversized or specially crafted 'service_type' parameter designed to overflow a stack or heap buffer. The buffer overflow overwrites adjacent memory regions, including function pointers or return addresses. The attacker gains arbitrary code execution with the privileges of the HTTP handler process (typically root-equivalent on embedded devices). The attacker can then persist access, exfiltrate network traffic, modify firewall rules, or pivot to internal network resources. Low complexity (AC:L) and direct network vector (AV:N) mean exploitation requires only standard HTTP tools; no special tricks needed. The authentication requirement (PR:L) limits blast radius to scenarios where credentials are already compromised or default credentials remain unchanged. Public POC availability means exploitation can be performed without sophisticated reverse-engineering.