CVE-2025-5786
Published: 06 June 2025
Summary
CVE-2025-5786 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink X15 Firmware. Its CVSS base score is 7.4 (High).
Operationally, ranked in the top 17.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-5786 is a buffer overflow vulnerability in the TOTOLINK X15 router firmware version 1.0.0-B20230714.1105. It resides in an unknown function within the file /boafrm/formDMZ of the HTTP POST Request Handler component. The flaw is triggered by improper handling of the submit-url argument supplied in an HTTP POST request and is tracked under CWE-119 and CWE-120. It carries a CVSS 4.0 score of 7.4 and permits remote exploitation without user interaction.
An authenticated attacker can send a crafted HTTP POST request to the affected endpoint from a remote network location. Successful exploitation grants the ability to overwrite memory, potentially leading to arbitrary code execution, denial of service, or full compromise of the device with high impact on confidentiality, integrity, and availability.
The exploit has been publicly disclosed, and references include a proof-of-concept on GitHub along with entries in the VulDB database. No vendor advisory or firmware patch details are provided in the available references, and the TOTOLINK support site is listed without accompanying mitigation guidance. The associated EPSS score remains low and essentially flat at approximately 0.0167–0.0168.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-17323
Vulnerability details
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formDMZ of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow.…
more
It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.