Yhuanhuan01

**Name of the Vulnerable Software and Affected Versions** TOTOLINK X15 version 1.0.0-B20230714.1105 **Description** A critical vulnerability was found in the TOTOLINK X15, affecting the function `formMapReboot` of the file `/boafrm/formMapReboot`. The manipulation of the `deviceMacAddr` argument leads to a stack-based buffer overflow. This issue can be exploited remotely. The vendor was contacted about the disclosure but did not respond. **Recommendations** For TOTOLINK X15 version 1.0.0-B20230714.1105, as a temporary workaround, consider disabling the `formMapReboot` function until a patch is available. Restrict access to the `/boafrm/formMapReboot` file to minimize the risk of exploitation. Avoid using the `deviceMacAddr` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.