PT-2025-26498 · Totolink · Totolink X15

Yuhongxiang

·

Published

2025-06-16

·

Updated

2025-06-21

·

CVE-2025-6402

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: TOTOLINK X15 version 1.0.0-B20230714.1105
Description: A critical vulnerability was found in the HTTP POST Request Handler component of the TOTOLINK X15, affecting the file /boafrm/formIpv6Setup. The manipulation of the submit-url argument leads to a buffer overflow. This issue can be initiated remotely. The exploit has been disclosed to the public and may be used. The vulnerability is related to improper restriction of operations within the bounds of a memory buffer and buffer copy without checking the size of the input, also known as a classic buffer overflow.
Recommendations: For TOTOLINK X15 version 1.0.0-B20230714.1105, as a temporary workaround, consider restricting access to the /boafrm/formIpv6Setup file and the HTTP POST Request Handler component to minimize the risk of exploitation. Avoid using the submit-url argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-07792
CVE-2025-6402

Affected Products

Totolink X15