CVE-2025-8244 is a high severity (CVSS 8.8) buffer overflow in the TOTOLINK X15 router, firmware 1.0.0-B20230714.1105. The macstr argument of /boafrm/formMapDelDevice is not handled safely. No fixed firmware is confirmed, so reduce exposure and check with the vendor. The exploit has been disclosed publicly.
What's affected
TOTOLINK X15 firmware 1.0.0-B20230714.1105 is the version named in the record and in the public write-up. The affected handler is /boafrm/formMapDelDevice in the HTTP POST request handler, and the argument is macstr.
Nothing I read names a fixed firmware. The write-up does not mention a patch, an advisory or a vendor reply, and the record cites no vendor page beyond the TOTOLINK site. Check TOTOLINK's download and support pages for newer firmware.
The two sources describe the problem a little differently. The record calls it a buffer overflow. The write-up says the same input leads to both a buffer overflow and a command injection, which is why the record also carries a command injection weakness. The record scores it 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which shows a low privilege requirement, so a login to the router's web interface is probably needed. The write-up shows no score of its own.
How to check if you're exposed
Check the firmware version in the router's administration page, usually under system status or firmware upgrade. If it reads V1.0.0-B20230714.1105, you are on the affected build.
Next, check whether the web interface is reachable from the internet. From a network outside yours, test whether the router's address answers on its web port. Remote management should be off unless you truly need it.
Then check which devices on your local network can reach the admin page. A guest network or a shared office network widens the group of people who can try.
What to do now
- List every TOTOLINK X15 you manage and its firmware build.
- Turn off remote administration and make sure the admin page is not forwarded to the internet.
- Change the admin password to a long unique one and remove default credentials.
- Keep the admin page reachable only from a trusted wired segment if you can.
- Ask TOTOLINK for a fixed firmware, and apply it when it exists. If the product is out of support, plan to replace it.
- Watch the router for unexplained reboots or setting changes.
Why it matters
The record lists CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Classic Buffer Overflow) and CWE-77 (Command Injection). A buffer overflow happens when data is copied into a space that is too small for it, and the extra data lands on neighboring memory. On embedded devices, that can crash the service or, in worse cases, let someone run their own code.
Routers sit at the edge of a network and rarely get patched on a schedule, which makes them a favorite place to persist. The record does not flag this CVE as CISA KEV and makes no claim of exploitation in the wild, though it says the exploit has been disclosed to the public.
Quick check
Is there a firmware fix for CVE-2025-8244?
I could not confirm one. Neither the record nor the public write-up names a fixed build, so check the vendor support page and plan around the possibility that none is coming.
Does turning off remote management help?
Yes. It removes the easiest path from the internet to the admin handler. It does not fix the flaw for anyone who can already reach the admin page from inside the network.
Sources
- CVE-2025-8244 on Safeguard Gold
- Public write-up
- NVD record for CVE-2025-8244, published 2025-07-27
Last reviewed: 18 October 2026.
