CVE-2025-8245
Published: 27 July 2025
Summary
CVE-2025-8245 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink X15 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A vulnerability has been identified in the TOTOLINK X15 router firmware version 1.0.0-B20230714.1105. It resides in an unknown function of the /boafrm/formMultiAPVLAN file within the HTTP POST Request Handler component. The issue stems from improper handling of the submit-url argument, resulting in a buffer overflow condition tracked under CWE-119 and CWE-120. The flaw carries a CVSS 4.0 score of 7.4 and is remotely triggerable.
Remote attackers with low privileges can exploit the weakness over the network without user interaction to achieve high impacts on confidentiality, integrity, and availability. Public exploit code has already been released, enabling potential remote code execution or denial-of-service outcomes on affected devices.
The EPSS score remains low at 0.0143 with a negligible peak of 0.0144, indicating limited observed exploitation interest to date. No vendor advisory or patch information is available from the listed references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22836
Vulnerability details
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAPVLAN of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads…
more
to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing web interface (/boafrm/formMultiAPVLAN) via remote HTTP POST enables exploitation of public-facing application (T1190) and application/system exploitation for denial of service (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs like the 'submit-url' argument to prevent buffer overflows from malformed HTTP POST requests.
SI-16 implements memory protections such as stack canaries or DEP to mitigate exploitation of buffer overflows in the HTTP handler.
SI-2 mandates timely remediation of identified flaws like this buffer overflow through firmware patching.