CVE-2025-5792: Totolink EX1200T Buffer Overflow Vulnerability

CVE-2025-5792 Overview

CVE-2025-5792 is a buffer overflow vulnerability in the TOTOLINK EX1200T Wi-Fi range extender running firmware version 4.1.2cu.5232_B20210713. The flaw resides in the HTTP POST request handler for /boafrm/formWlanRedirect, where manipulation of the redirect-url argument overflows a fixed-size buffer [CWE-119]. Remote attackers with low-privileged access can trigger the condition over the network. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic exploitation against exposed devices.

Critical Impact
Remote attackers can corrupt memory on affected TOTOLINK EX1200T devices, potentially achieving arbitrary code execution on the router and pivoting into internal networks.

Affected Products

TOTOLINK EX1200T hardware (range extender)
TOTOLINK EX1200T firmware 4.1.2cu.5232_B20210713
Deployments exposing the device management interface to untrusted networks

Discovery Timeline

2025-06-06 - CVE-2025-5792 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5792

Vulnerability Analysis

The TOTOLINK EX1200T exposes a web management interface powered by the boa HTTP server. The endpoint /boafrm/formWlanRedirect accepts POST parameters used to configure wireless redirection behavior. The handler copies the attacker-supplied redirect-url parameter into a fixed-size stack or heap buffer without validating its length.

Oversized input overwrites adjacent memory, corrupting control data such as saved return addresses or function pointers. On embedded MIPS/ARM firmware without modern exploit mitigations, this class of buffer overflow frequently allows attackers to hijack execution flow. The public disclosure of exploit details lowers the barrier to weaponization.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer [CWE-119]. The formWlanRedirect handler uses unsafe string copy semantics on redirect-url without enforcing a maximum length. TOTOLINK consumer firmware typically lacks stack canaries, Address Space Layout Randomization (ASLR), and non-executable stacks, allowing straightforward memory corruption.

Attack Vector

Exploitation requires network access to the device's HTTP management interface and low-privileged credentials. An attacker sends a crafted HTTP POST request to /boafrm/formWlanRedirect with an overlong redirect-url value. When the device processes the request, the oversized value overflows the destination buffer, corrupts adjacent memory, and can redirect execution to attacker-controlled data.

Successful exploitation impacts confidentiality, integrity, and availability of the device. Compromised routers can be used to intercept traffic, alter DNS responses, or serve as a foothold into the internal network. Technical documentation is available at GitHub CVE Documentation and VulDB Entry #311339.

No verified proof-of-concept code is included. The vulnerability is triggered
by sending an HTTP POST request to /boafrm/formWlanRedirect with an
over-length value in the redirect-url parameter. Refer to the linked
advisories for technical details.

Detection Methods for CVE-2025-5792

Indicators of Compromise

HTTP POST requests to /boafrm/formWlanRedirect containing unusually long redirect-url values (hundreds or thousands of bytes).
Unexpected reboots, crashes, or watchdog-triggered restarts of TOTOLINK EX1200T devices following inbound HTTP traffic.
Outbound connections from the router to unknown IP addresses, especially on non-standard ports, indicating a possible implant.
Changes to DNS server settings, firewall rules, or administrative credentials without operator action.

Detection Strategies

Inspect HTTP request logs at network chokepoints for POST requests targeting formWlanRedirect with anomalous payload sizes.
Deploy IDS/IPS signatures that flag requests to the boafrm URI namespace originating from untrusted network segments.
Correlate router management-plane traffic with authorized administrator source addresses; alert on deviations.

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized log store for longitudinal analysis.
Baseline expected traffic volumes to the router's management interface and alert on spikes.
Monitor for firmware integrity changes and configuration drift across managed edge devices.

How to Mitigate CVE-2025-5792

Immediate Actions Required

Restrict access to the EX1200T web management interface to trusted management VLANs or specific administrator IP addresses.
Disable remote WAN-side administration if enabled, ensuring the device is not reachable from the internet.
Rotate administrative credentials on the device and enforce strong, unique passwords.
Inventory all TOTOLINK EX1200T deployments and identify units running firmware 4.1.2cu.5232_B20210713.

Patch Information

At the time of publication, no vendor-supplied patch is referenced in the NVD entry for CVE-2025-5792. Administrators should monitor the TOTOLINK Official Website for firmware updates addressing the formWlanRedirect handler. If a fixed firmware release becomes available, apply it after validating integrity and taking a configuration backup.

Workarounds

Place the EX1200T behind a network firewall that blocks inbound HTTP/HTTPS traffic to the device from untrusted zones.
Segment the router's management interface onto a dedicated management network unreachable from guest or IoT subnets.
If no patch is available and the device is exposed, consider replacing it with a supported model that receives current security updates.

bash

# Example: restrict management access using an upstream firewall (iptables)
# Allow only the admin workstation to reach the EX1200T web UI on 192.0.2.10
iptables -A FORWARD -s 203.0.113.5 -d 192.0.2.10 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP