CVE-2025-5502

TOTOLINK X15, v1.0.0-B20230714.1105, contains a command injection in the function formMapReboot (file /boafrm/formMapReboot) triggered by manipulating the deviceMacAddr parameter. Attack surface may be remote; exploit has been disclosed publicly and vendor did not respond. A PT-security write-up ...