Ex1200t Firmware EUVD-2025-17616

This vulnerability presents HIGH real-world risk despite requiring authenticated access (PR:L in CVSS vector). Risk signals align strongly: CVSS 8.8 reflects high impact (HII - confidentiality, integrity, availability all compromised), CVSS vector shows network-accessible attack (AV:N, AC:L), and CWE-119 buffer overflows are reliably exploitable. The critical risk factors are: (1) Public exploit code exists, enabling low-skill attackers; (2) Buffer overflows in embedded systems often achieve code execution without ASLR/DEP protections typical in consumer routers; (3) Post-authentication requirement is a moderate control but many users have weak default credentials or unchanged default passwords; (4) The router's network-facing position makes it an attractive pivot point. SSVC analysis: Exploitation status=PUBLIC (POC available), Automatable=HIGH (buffer overflow exploits typically automate well), Technical Impact=TOTAL (code execution on router enables lateral movement, DNS spoofing, traffic interception, botnet recruitment). This is NOT a 'high-CVSS-low-risk' issue—it represents material compromise potential for affected organizations managing fleets of TOTOLIK routers. EPSS would likely be elevated (60%+) given public POC and authentication bypass potential.

A user account on the internal network (or an attacker with default credentials 'admin:admin' commonly unchanged in TOTOLINK devices) crafts a malicious HTTP POST request with an oversized payload targeting /boafrm/formWsc endpoint. The POST body contains carefully structured binary data exceeding expected buffer sizes for parameters like SSID, password, or configuration fields. Due to missing bounds checking in the C-based HTTP handler, this overwrites the stack, potentially overwriting a function return pointer. The attacker crafts the overflow to inject shell code that executes with root privileges (typical router privilege model). Exploitation could: (1) Install persistent backdoor in router firmware; (2) Redirect DNS queries to attacker-controlled servers; (3) Intercept HTTPS traffic via MITM; (4) Use router to pivot into internal network segments; (5) Recruit router into botnet for DDoS attacks. If public POC exists (highly likely given 'disclosed to public' status), script kiddies can automate this against networks with unchanged default credentials.