CVE-2025-5502: TOTOLINK X15 formMapReboot command injection
A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this issue is the function formMapReboot of the file /boafrm/formMapReboot. The manipulation of the argument deviceMacAddr leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5502?
CVE-2025-5502 is classified as a critical vulnerability.
How do I fix CVE-2025-5502?
To fix CVE-2025-5502, it is recommended to update to the latest version of TOTOLINK X15 firmware that addresses this vulnerability.
What impact does CVE-2025-5502 have on the TOTOLINK X15 device?
CVE-2025-5502 allows for command injection via the function formMapReboot, which can compromise the security of the device.
Can CVE-2025-5502 be exploited remotely?
Yes, CVE-2025-5502 can be exploited remotely if the affected function is accessible over the network.
What is the affected version for CVE-2025-5502?
CVE-2025-5502 affects TOTOLINK X15 version 1.0.0-B20230714.1105.