Ex1200t Firmware EUVD-2025-18419

This vulnerability presents HIGH real-world risk despite being marked as 'critical' rather than 'critical-and-actively-exploited.' Key risk factors: (1) CVSS 8.8 reflects high impact but requires authenticated access (PR:L), reducing attack surface compared to unauthenticated exploits; (2) public POC availability increases probability of weaponization; (3) KEV status unknown from provided data but disclosure suggests active interest; (4) EPSS probability likely elevated due to POC availability and firmware deployment in consumer networks; (5) SSVC considerations: exploitation is likely automatable given POC exists, technical impact is complete system compromise (code execution as root equivalent on router), and many devices remain unpatched due to typical poor update rates in consumer IoT. The authentication requirement is a mitigating factor but weak: many routers ship with default/weak credentials, are accessed on local networks where attackers may already reside, or users may click malicious links triggering CSRF-style attacks. Priority: HIGH for any organization managing TOTOLINK devices; moderate-to-high for ISPs and managed service providers dealing with customer premises equipment.

An attacker on the same local network (or with network access to the router's management interface) obtains valid credentials through credential stuffing, phishing, or exploitation of a prior vulnerability. The attacker crafts a malicious HTTP POST request to the /boafrm/formSaveConfig endpoint with an oversized 'submit-url' parameter containing shellcode or ROP gadgets. The buffer overflow overwrites the stack, including a return address pointing to shellcode. When the vulnerable function returns, code execution occurs with the privileges of the web service (typically root on embedded devices). The attacker gains complete control: establishing a reverse shell, installing persistent backdoors, exfiltrating network traffic, modifying firewall rules, or using the compromised router as a pivot point into the internal network. Exploitation time: minutes. Impact: total device compromise and potential lateral movement.