PT-2025-25598 · Totolink · Totolink X15

Lena-Lyy02

·

Published

2025-06-09

·

Updated

2025-06-23

·

CVE-2025-6146

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions TOTOLINK X15 version 1.0.0-B20230714.1105
Description A critical issue has been found, affecting an unknown part of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the submit-url argument leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Recommendations For TOTOLINK X15 version 1.0.0-B20230714.1105, as a temporary workaround, consider restricting access to the HTTP POST Request Handler component to minimize the risk of exploitation. Avoid using the submit-url argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-07010
CVE-2025-6146

Affected Products

Totolink X15