Listen to this Post
How the CVE Works
CVE-2025-6165 is a critical buffer overflow vulnerability in TOTOLINK X15 firmware version 1.0.0-B20230714.1105. The flaw exists in the `/boafrm/formTmultiAP` endpoint, which processes HTTP POST requests. The `submit-url` parameter is improperly sanitized, allowing an attacker to overflow the buffer by sending a crafted payload. This can lead to remote code execution (RCE) or device crash. The vulnerability is remotely exploitable, and public exploits exist, increasing its risk.
DailyCVE Form
Platform: TOTOLINK X15
Version: 1.0.0-B20230714.1105
Vulnerability: Buffer Overflow
Severity: Critical
Date: 06/23/2025
Prediction: Patch by 08/2025
What Undercode Say
Analytics:
curl -X POST -d "submit-url=<BUFFER_OVERFLOW_PAYLOAD>" http://<TARGET_IP>/boafrm/formTmultiAP
payload = "A" 1024 Overflow trigger
requests.post(f"http://<TARGET_IP>/boafrm/formTmultiAP", data={"submit-url": payload})
Exploit:
- Crafted HTTP POST request to `/boafrm/formTmultiAP` with oversized
submit-url. - Exploit publicly available (PoC likely in Metasploit).
Protection from this CVE:
- Disable remote admin access.
- Apply vendor patch.
- Use network segmentation.
Impact:
- Remote code execution.
- Device compromise.
- Unauthorized access.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
