CVE-2025-8246
Published: 27 July 2025
Summary
CVE-2025-8246 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink X15 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A vulnerability rated critical has been identified in the TOTOLINK X15 router running firmware version 1.0.0-B20230714.1105. The issue resides in an unknown function within the file /boafrm/formRoute that is part of the HTTP POST Request Handler component. Improper handling of the submit-url argument permits a buffer overflow, tracked under CWE-119 and CWE-120, with a CVSS 4.0 score of 7.4 reflecting network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.
An authenticated remote attacker can send a crafted HTTP POST request to the affected endpoint, triggering the overflow to execute arbitrary code or crash the device. The exploit has already been published publicly, enabling any party with network access and valid credentials to leverage it without additional user interaction.
The associated EPSS score remains low at 0.0143 with a peak of only 0.0144, indicating limited observed exploitation interest since disclosure. No vendor advisory or patch information is detailed in the available references, which primarily point to a proof-of-concept repository and vulnerability databases.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22835
Vulnerability details
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formRoute of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads…
more
to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing router web interface (/boafrm/formRoute) via remote HTTP POST enables exploitation of public-facing applications (T1190) and application exploitation for denial of service (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents buffer overflows by requiring validation of untrusted inputs like the manipulated 'submit-url' argument in HTTP POST requests.
SI-16 mitigates buffer overflow exploitation through memory protections such as non-executable memory regions and address space randomization.
SI-2 requires timely remediation of identified flaws like this buffer overflow vulnerability via patching the affected firmware.