CVE-2025-5910

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-591005.9The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download CVE-2025-591017.7Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logg CVE-2025-591026.9The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database c CVE-2025-591039.2The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new ha CVE-2025-591047.0With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-con CVE-2025-591057.0With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of mis CVE-2025-591068.8The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is agai CVE-2025-591078.5Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some in CVE-2025-591089.2By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enfo CVE-2025-591095.1The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press CVE-2025-59118.8A vulnerability was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknow CVE-2025-591106.5Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed b