CVE-2025-5786
BaseFortify
Publication date: 2025-06-06
Last updated on: 2025-06-10
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | x15_firmware | 1.0.0-b20230714.1105 |
| totolink | x15 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-5786 is a critical buffer overflow vulnerability in the TOTOLINK X15 router firmware version 1.0.0-B20230714.1105. It occurs in the HTTP POST request handler at the endpoint /boafrm/formDMZ, specifically involving the submit-url parameter. The vulnerability arises because the router copies input data to an output buffer without checking if the input size exceeds the buffer size, leading to a buffer overflow. This flaw allows an attacker to remotely exploit the device by sending a specially crafted HTTP POST request, potentially causing denial of service or other impacts. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to exploit the buffer overflow to disrupt the normal operation of the TOTOLINK X15 router. The consequences include denial of service (DoS), and it affects the confidentiality, integrity, and availability of the device. Since the exploit requires no authentication and is publicly available, it poses a significant risk to network security and device stability. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests targeting the endpoint /boafrm/formDMZ with the submit-url parameter. Detection can involve capturing and inspecting HTTP traffic for unusually large or malformed POST requests to this endpoint. Using tools like curl or wget to test the endpoint with crafted requests may help identify vulnerable devices. For example, a command to test could be: curl -X POST http://<target-ip>/boafrm/formDMZ -d "submit-url=<large_payload>". Network intrusion detection systems (NIDS) can be configured to alert on such suspicious POST requests to /boafrm/formDMZ. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected TOTOLINK X15 router firmware version 1.0.0-B20230714.1105 with an alternative device or firmware version if available, as no official patches or mitigations have been provided. Additionally, restricting access to the router's web interface from untrusted networks, implementing network segmentation, and blocking HTTP POST requests to /boafrm/formDMZ at network perimeter devices can reduce exposure. Monitoring for exploit attempts and disabling remote management if not needed are also recommended. [2]