CVE-2025-8243
Published: 27 July 2025
Summary
CVE-2025-8243 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink X15 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A vulnerability classified as critical exists in TOTOLINK X15 firmware version 1.0.0-B20230714.1105. It affects unknown processing within the /boafrm/formMapDel file of the HTTP POST Request Handler component, where manipulation of the devicemac1 argument triggers a buffer overflow. The issue is tracked under CWE-119, CWE-120, and CWE-787, carries a CVSS 4.0 score of 7.4 reflecting network attack vector, low complexity, and high impact on confidentiality, integrity, and availability, and can be triggered remotely.
An authenticated remote attacker can send a crafted HTTP POST request to exploit the flaw and achieve arbitrary code execution or denial of service on the affected device. Public exploit code has already been disclosed, enabling potential use by threat actors with limited privileges.
The EPSS score remains low at approximately 0.023 with no material increase after disclosure. Vendor references point to the TOTOLINK site and detailed vulnerability reports, but no specific mitigation guidance or patch availability is documented in the provided sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22834
Vulnerability details
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This issue affects some unknown processing of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads to buffer overflow. The…
more
attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing HTTP POST handler (/boafrm/formMapDel) directly enables remote exploitation of the router's web interface for code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Implements input validation mechanisms at HTTP POST endpoints to restrict the devicemac1 argument and prevent buffer overflows.
Enforces memory protections like non-executable stacks and ASLR to mitigate exploitation of the buffer overflow even if triggered.
Requires timely identification, reporting, and correction of the specific buffer overflow flaw in the router firmware.