EUVD-2025-18453
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical remote buffer overflow vulnerability in TOTOLINK X15 router firmware (version 1.0.0-B20230714.1105) affecting the HTTP POST request handler for the /boafrm/formMultiAP endpoint. An authenticated attacker can exploit improper input validation on the 'submit-url' parameter to achieve complete system compromise including confidentiality, integrity, and availability breaches. A public proof-of-concept exists and the vulnerability is actively exploitable without user interaction.
Technical Context
This vulnerability is a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) buffer overflow in embedded router firmware. The affected component is the HTTP POST request handler—likely implemented in C/C++ within the router's web administrative interface. The /boafrm/formMultiAP endpoint processes multi-AP configuration requests, and the 'submit-url' parameter lacks proper bounds checking before being written to a fixed-size buffer. This is typical of legacy embedded device code where memory constraints were less flexible but input validation was often overlooked. The CPE identifier would be: cpe:2.3:o:totolink:x15_firmware:1.0.0-b20230714.1105:*:*:*:*:*:*:* (or similar firmware variant). TOTOLINK devices use proprietary web interfaces typically running on lightweight HTTP servers (often Boa or similar), which have historically been susceptible to memory safety issues.
Affected Products
X15 (['1.0.0-B20230714.1105'])
Remediation
No vendor patch details are provided in the CVE description; however, standard remediation approaches include: (1) Immediate: Restrict network access to the HTTP administrative interface using firewall rules (block WAN access to port 80/443 if possible); (2) Temporary mitigation: Change default credentials and disable remote management if not required; (3) Permanent: Monitor TOTOLINK security advisories for a patched firmware version (likely 1.0.0-B20230714.1106 or later). Contact TOTOLINK technical support ([email protected]) for patch availability. Until patched, do NOT expose the router's web interface to untrusted networks. Consider network segmentation to isolate administrative access. Firmware update procedures: access router admin panel → System Settings → Firmware Upgrade → select patched binary (when available).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today