CVE-2025-8246
Published: 27 July 2025
Summary
CVE-2025-8246 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink X15 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents buffer overflows by requiring validation of untrusted inputs like the manipulated 'submit-url' argument in HTTP POST requests.
SI-16 mitigates buffer overflow exploitation through memory protections such as non-executable memory regions and address space randomization.
SI-2 requires timely remediation of identified flaws like this buffer overflow vulnerability via patching the affected firmware.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing router web interface (/boafrm/formRoute) via remote HTTP POST enables exploitation of public-facing applications (T1190) and application exploitation for denial of service (T1499.004).
NVD Description
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formRoute of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads…
more
to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-8246 is a critical buffer overflow vulnerability, rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), affecting the TOTOLINK X15 router running firmware version 1.0.0-B20230714.1105. The flaw resides in an unknown functionality of the /boafrm/formRoute file within the HTTP POST Request Handler component. It is triggered by manipulating the "submit-url" argument in a POST request, leading to a buffer overflow classified under CWE-119 and CWE-120.
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring only network access, low attack complexity, and no user interaction. Successful exploitation grants high impacts across confidentiality, integrity, and availability, potentially enabling arbitrary code execution or system compromise on the affected device.
VulDB advisories document the issue (ctiid.317834, id.317834, submit.622697) and note that the exploit has been publicly disclosed, including a proof-of-concept at https://github.com/panda666-888/vuls/blob/main/totolink/x15/formRoute.md. The vendor's site at https://www.totolink.net/ is referenced, though no specific patch or mitigation details are outlined in the available information.
Details
- CWE(s)