CVE-2025-6402 - TOTOLINK X15 HTTP POST Request formIpv6Setup buffer overflow

Back Back to CVE browser

HIGH

TOTOLINK X15 HTTP POST Request formIpv6Setup buffer overflow

Published Jun 21, 2025

8.7

HIGH

CVSS 4.0

EPSS 0.96%

Description

A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formIpv6Setup of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

Vendor TOTOLINK Product n/a Default
n/a
- Version
  1.0.0-B20230714.1105
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TOTOLINK

n/a

Version	Status	Constraints
1.0.0-B20230714.1105	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-120

Classic Buffer Overflow

References (5)

https://github.com/d2pq/cve/blob/main/616/22.md
exploitThird Party Advisory
https://vuldb.com/?ctiid.313396
signaturepermissions-requiredPermissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?id.313396
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.597693
third-party-advisoryThird Party AdvisoryVDB Entry
https://www.totolink.net/
product

Link	Providers	Tags
https://github.com/d2pq/cve/blob/main/616/22.md		exploitThird Party Advisory
https://vuldb.com/?ctiid.313396		signaturepermissions-requiredPermissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?id.313396		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.597693		third-party-advisoryThird Party AdvisoryVDB Entry
https://www.totolink.net/		product