Listen to this Post
How the CVE Works
CVE-2025-5908 is a critical buffer overflow vulnerability in TOTOLINK EX1200T routers (up to firmware version 4.1.2cu.5232_B20210713). The flaw exists in the HTTP POST request handler component, specifically in the `/boafrm/formIpQoS` endpoint. Attackers can exploit this by sending a crafted HTTP POST request with oversized data, overflowing the buffer and potentially executing arbitrary code. The vulnerability is remotely exploitable, requiring no authentication, and has a publicly disclosed exploit.
DailyCVE Form
Platform: TOTOLINK EX1200T
Version: ≤ 4.1.2cu.5232_B20210713
Vulnerability: Buffer Overflow
Severity: Critical
Date: 06/16/2025
Prediction: Patch by 07/15/2025
What Undercode Say
Analytics
curl -X POST -d "payload=OVERFLOW" http://<target>/boafrm/formIpQoS
import requests
requests.post("http://<target>/boafrm/formIpQoS", data={"payload": "A"1000})
Exploit
- Crafted HTTP POST request
- No authentication required
- Remote code execution
Protection from this CVE
- Update firmware
- Disable remote admin
- Filter HTTP requests
Impact
- Remote code execution
- Device compromise
- Network infiltration
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
