Loading story…
A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2025-52906 with a CVSS score of 9.3, has been discovered in TOTOLINK X6000R routers. This flaw allows attackers to execute arbitrary commands on affected devices without authentication, posing a severe risk to users of these widely deployed consumer networking products. The vulnerability is present in firmware version V9.4.0cu.1360_B20241207, which was released on March 28, 2025. In addition to CVE-2025-52906, two other significant vulnerabilities were identified in the same firmware: CVE-2025-52905, an argument injection flaw that can trigger denial-of-service (DoS) conditions, and CVE-2025-52907, a security bypass that could lead to persistent DoS or arbitrary file writes, with the potential for chained attacks resulting in RCE. The unauthenticated command injection vulnerability (CVE-2025-52906) is considered the most critical, as it enables attackers to compromise the device remotely and potentially use it as a foothold for further attacks on connected networks. Palo Alto Networks' Unit 42 team conducted a technical analysis of these vulnerabilities, detailing their root causes and demonstrating their impacts. The widespread use of TOTOLINK routers in consumer and small business environments amplifies the potential impact of these flaws. TOTOLINK has responded by releasing updated firmware to address the vulnerabilities, and users are strongly advised to apply these updates immediately to mitigate risk. Security solutions such as Palo Alto Networks' Next-Generation Firewall and Device Security offerings can help detect and block exploitation attempts. The vulnerabilities highlight the ongoing risks associated with IoT and consumer networking devices, which are often targeted due to their broad deployment and sometimes limited security controls. Attackers exploiting CVE-2025-52906 could gain full control over the router, intercept network traffic, or launch further attacks against internal or external targets. The technical details provided by researchers enable defenders to better understand the attack vectors and implement appropriate mitigations. Organizations and individuals using TOTOLINK X6000R routers should assess their exposure and ensure that all devices are updated to the latest firmware version. The incident underscores the importance of timely vulnerability disclosure and coordinated response between vendors and security researchers. Monitoring for signs of compromise and unusual network activity is recommended for all potentially affected environments. The discovery of these vulnerabilities serves as a reminder of the critical need for robust security practices in the management of network infrastructure devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A vulnerability report identified CVE-2025-52906 as a critical TOTOLINK X6000R flaw with a CVSS score of 9.3 that allows unauthenticated remote code execution.
Palo Alto Networks Unit 42 disclosed three newly identified vulnerabilities affecting TOTOLINK X6000R routers, including issues that could expose devices to serious compromise.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, **CVE-2025-13184**, in the **TOTOLINK X5000R (AX1800)** home router allows an attacker with access to the device’s management interface—or physical access to the router—to enable **Telnet** without authentication and log in as **root** with no password. The flaw was confirmed in firmware version `V9.1.0u.6369_B20230113`, and earlier versions may also be affected. Publicly known exploitation can lead to full device compromise, arbitrary code execution, configuration tampering, traffic manipulation, exposure of sensitive network data, botnet enrollment, and lateral movement to other devices on the local network. No vendor patch was reported as available at the time of publication, prompting guidance to treat the X5000R as untrusted from an access-control perspective and avoid connecting it directly to the internet. Recommended mitigations include keeping the management panel inaccessible from the public internet, verifying network segmentation and cabling, replacing the firmware with an alternative such as **OpenWrt** where feasible, or removing and securely disposing of the device if the risk cannot be managed. A key indicator of compromise is **TCP port 23** being open on the router, suggesting Telnet has been enabled maliciously.
Jun 29, 2026
A critical vulnerability, tracked as CVE-2025-13184, has been discovered in the TOTOLINK AX1800 wireless router, allowing remote attackers to bypass authentication and enable the Telnet service via a crafted HTTP request to the `/cgi-bin/cstecgi.cgi?action=telnet` endpoint. This flaw permits unauthenticated users to gain root-level access to the device, enabling arbitrary command execution and full administrative control without requiring a password. The vulnerability affects at least the X5000R V9.1.0u.6369_B20230113 firmware and potentially earlier versions with similar implementations, and there is currently no official patch available. With root access, attackers can modify DNS settings, intercept network traffic, and use the compromised router as a foothold for further attacks within the local network. The CERT Coordination Center has issued an advisory warning of the severe implications, including the risk of lateral movement and persistent compromise if the router's management interface is exposed to the internet. The vulnerability is rated as critical (CVSS 9.8), and users are urged to restrict remote access and monitor for suspicious activity until a fix is released.
Jun 29, 2026
Two Totolink router models, **A7100RU** and **A8000RU**, were disclosed with critical OS command injection vulnerabilities in the CGI handler endpoint `/cgi-bin/cstecgi.cgi`. The flaws affect the `setVpnPassCfg` function and stem from improper handling of the `pptpPassThru` argument, allowing attackers to inject operating system commands remotely. The issues were assigned **CVE-2026-5850** for the A7100RU running firmware `7.4cu.2313_b20191024` and **CVE-2026-7037** for the A8000RU running firmware `7.1cu.643_b20200521`. Both vulnerabilities are classified under **CWE-78** and **CWE-77**, and were reported as remotely exploitable without privileges or user interaction. The disclosures indicate that **public exploits are available**, materially raising the risk of opportunistic compromise of exposed devices. Severity scoring across **CVSS v2**, **CVSS v3.1**, and **CVSS v4.0** places the flaws at critical or maximum-impact levels, making internet-facing Totolink routers running the affected firmware high-priority targets for remediation or isolation.
Jun 29, 2026