CVE-2025-5502 is a medium severity command injection in the TOTOLINK X15 router, firmware 1.0.0-B20230714.1105. The deviceMacAddr argument of the formMapReboot handler can carry commands to the device. The reporter says the vendor did not respond, and no fixed firmware is named.
What's affected
- Product: TOTOLINK X15 router and its firmware.
- Affected: firmware 1.0.0-B20230714.1105, per the record.
- Component: the function formMapReboot at
/boafrm/formMapReboot, argumentdeviceMacAddr. - Fixed firmware: none is named. The record says the vendor was contacted early and did not respond in any way.
- Authentication: the vector shows low privileges required, so a login to the admin interface is needed.
Exploit information is public according to the record. The CVE is not on the CISA KEV list.
How to check if you're exposed
Check the firmware version on the router's admin page, and compare it with 1.0.0-B20230714.1105.
- Find out whether the admin interface is reachable from the internet. If remote management is on, switch it off.
- Count the TOTOLINK devices in your estate. Small office and branch networks often have routers that were never recorded.
- Check TOTOLINK's download page for a newer image for the X15. The record gives none, so look for one yourself.
Routers are not software packages, so a dependency scan will not list them. Use a network device inventory.
What to do now
- Locate every X15 on your networks.
- Check the vendor's download page for newer firmware, and install it if present after reading its notes.
- Turn off remote administration, and limit the admin interface to the local network.
- Replace default or shared admin passwords, since the flaw needs a login.
- If the vendor offers no fix, plan to replace the device, and segment it from sensitive systems in the meantime.
Why it matters
Command injection on consumer and small business routers has a long history. The firmware passes a value from a web form to a system command without cleaning it, so extra text becomes extra commands. The record also lists out-of-bounds write and injection classes, which signals that the handler deals with its input in an unsafe way at more than one level.
The fix belongs in the firmware, which is why a silent vendor is the real problem. Without a patch, the choices are to reduce who can reach the interface, or to replace the device. Network placement matters here: a router that can only be administered from a trusted wired port is a very different risk from one with a public admin page.
The weakness is classed as CWE-74 (Injection) and CWE-77 (Command Injection) and CWE-787 (Out-of-bounds Write). Severity in the CVE record: medium, CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Quick check
Is there a patched firmware?
None is named in the record, and the reporter says the vendor did not respond. Check TOTOLINK's site for a newer image.
Why is the severity medium?
The vector needs a logged in user and rates impact as low in each category. If the admin page is public or the password is weak, the real risk is higher.
Sources
- Researcher write-up on GitHub (listed in the CVE record, not fetched)
- VulDB entry 310916 (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
