Ex1200t Firmware EUVD-2025-17613

This vulnerability presents a high real-world risk despite moderate CVSS complexity factors. The CVSS 3.1 score of 8.8 reflects: (1) Network attack vector (AV:N) — remotely exploitable without requiring network pivoting; (2) Low complexity (AC:L) — no special conditions needed; (3) Low privilege requirement (PR:L) — requires authentication, but many routers have default/weak credentials or allow local network access from compromised devices; (4) Complete impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The public disclosure of exploit code and availability of proof-of-concept significantly elevates practical risk. EPSS exploitation probability would likely be high (>0.90) given public POC availability. The vulnerability meets critical KEV criteria: it affects widely-deployed networking equipment, requires only authentication (often bypassable on SOHO devices via LAN access or credential compromise), and enables remote code execution. Attack surface includes any user with router admin access (intentional or compromised), making this exploitable in multi-user networks, guest networks, or after credential leakage. This is a true priority vulnerability, not a high-CVSS-low-risk situation.

An attacker gains access to the target network (either physically on the local network or via compromised credentials obtained through credential stuffing/phishing). The attacker sends a specially crafted HTTP POST request to http://[router-ip]/boafrm/formIpQoS with an oversized payload in the QoS configuration parameters that exceeds the buffer boundary. The lack of bounds checking in the vulnerable code allows the attacker to overwrite adjacent memory regions, including the stack where return addresses are stored. By carefully constructing the payload, the attacker overwrites the return address with a pointer to injected shellcode, gaining arbitrary code execution on the router with root privileges. This allows the attacker to: (1) install persistent backdoors or botnet malware; (2) capture network traffic and credentials from connected devices; (3) perform man-in-the-middle attacks on network traffic; (4) pivot to other network devices; or (5) disable the router's security features. A proof-of-concept exploit exists, lowering the technical barrier to exploitation. The attack requires only HTTP POST capability and brief network access, making it feasible from multiple attack vectors including compromised IoT devices on the same network.