PT-2025-31027 · Totolink · Totolink X15

Panda_0X1 · Published 2025-07-25 · Updated 2025-08-01 · CVE-2025-8244

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK X15 version 1.0.0-B20230714.1105

Description A critical vulnerability exists in the TOTOLINK X15 device. The issue is a buffer overflow within an unknown function of the HTTP POST Request Handler component, specifically in the file /boafrm/formMapDelDevice. Manipulation of the macstr argument can trigger this overflow, potentially leading to a denial of service or arbitrary code execution. The attack can be launched remotely. The exploit for this vulnerability has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Buffer Overflow

Weakness Enumeration

CWE-77

CWE-119

CWE-120

Related Identifiers

BDU:2025-09072

CVE-2025-8244

Affected Products

Totolink X15

References · 13

• 🔥 https://github.com/panda666-888/vuls/blob/main/totolink/x15/formMapDelDevice.md · Exploit
• https://bdu.fstec.ru/vul/2025-09072 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8244 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8244 · Security Note
• https://vuldb.com/?submit.622692 · Note
• https://totolink.net · Note
• https://t.me/cveNotify/130187 · Telegram Post
• https://vuldb.com/?ctiid.317832 · Note
• https://twitter.com/CVEnew/status/1949600858800611719 · Twitter Post
• https://twitter.com/cracbot/status/1951236533748470019 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1949598706593845461 · Twitter Post
• https://twitter.com/CveFindCom/status/1949593194099855471 · Twitter Post
• https://vuldb.com/?id.317832 · Note