CVE-2025-6824

🗓️ 28 Jun 2025 20:00:17Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 24 Views🌐 WEB

Critical vulnerability in TOTOLINK X15 allows remote buffer overflow via HTTP POST request submission

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the formParentControl() function in TOTOLINK X15 software allows a intruder to execute arbitrary commands.	20 Aug 202500:00	–	bdu_fstec
Circl	CVE-2025-6824	28 Jun 202520:55	–	circl
CNNVD	TOTOLINK X15 安全漏洞	28 Jun 202500:00	–	cnnvd
CNVD	TOTOLINK X15 Buffer Overflow Vulnerability	30 Jun 202500:00	–	cnvd
Cvelist	CVE-2025-6824 TOTOLINK X15 HTTP POST Request formParentControl buffer overflow	28 Jun 202520:00	–	cvelist
EUVD	EUVD-2025-19456	3 Oct 202520:07	–	euvd
NVD	CVE-2025-6824	28 Jun 202520:15	–	nvd
OSV	CVE-2025-6824	28 Jun 202520:15	–	osv
Positive Technologies	PT-2025-27325 · Totolink · Totolink X15	28 Jun 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-6824	30 Jun 202520:47	–	redhatcve

NVD

Node

AND

totolink x15_firmwareRange≤1.0.0-b20230714.1105

totolink x15Match-

[
  {
    "vendor": "TOTOLINK",
    "product": "X15",
    "versions": [
      {
        "version": "1.0.0-B20230714.1105",
        "status": "affected"
      }
    ],
    "modules": [
      "HTTP POST Request Handler"
    ]
  }
]

Source	Link
totolink	www.totolink.net/
github	www.github.com/awindog/cve/blob/main/688/28.md
vuldb	www.vuldb.com/
github	www.github.com/awindog/cve/blob/main/688/28.md
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
submit-url	request body	/boafrm/formParentControl	Buffer overflow via submit-url in POST request to /boafrm/formParentControl	CWE-120, CWE-119

17 Jun 2026 10:02Current

8.9High risk

Vulners AI Score8.9

CVSS 3.17.5 - 8.8

CVSS 48.7

CVSS 29

CVSS 38.8

EPSS0.00804

SSVC