CVE-2025-5907: A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This vulnerability affects unknown code of the file…

PriorityP267high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

4.28%

90.0th percentile

A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
totolink	ex1200t	—	—
totolink	ex1200t_firmware	<= 4.1.2cu.5232_b20210713	—

Detection & IOCsextracted from sources · hover to see the quote

path/boafrm/formFilter↗

commandPOST /boafrm/formFilter with body parameter ip6addr= containing >=100 bytes before & or end of body

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink formFilter ip6addr Parameter Buffer Overflow Attempt (CVE-2025-5907)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:18; content:"/boafrm/formFilter"; fast_pattern; http.request_body; content:"ip6addr|3d|"; pcre:"/^[^\x26]{100,}(?:\x26|$)/R"; reference:url,github.com/byxs0x0/cve2/blob/main/3.md; reference:cve,2025-5907; classtype:web-application-attack; sid:2062867; rev:1; metadata:affected_product TOTOLINK, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_06_10, cve CVE_2025_5907, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag AI_Generated_Description, updated_at 2025_06_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Detect HTTP POST requests to the exact URI /boafrm/formFilter (URI length is exactly 18 bytes) targeting TOTOLINK EX1200T devices. ↗
→Flag requests where the ip6addr POST body parameter value is 100 or more characters long (before an & separator or end of body), indicating a buffer overflow attempt. ↗
→The exploit is only transmitted in plaintext (TLS state: plaintext), so inspection of unencrypted HTTP traffic on perimeter and internal segments is sufficient. ↗
→Map detections to MITRE ATT&CK T1190 (Exploit Public-Facing Application) under tactic TA0001 (Initial Access). ↗

·Affected versions are TOTOLINK EX1200T up to and including 4.1.2cu.5232_B20210713; scope detection to this specific device/firmware range to reduce false positives. ↗
·The vulnerable handler is the HTTP POST Request Handler for /boafrm/formFilter; the overflow is triggered via the ip6addr parameter, not other parameters in the same form. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.