TOTOLINK AX1800 Router Unauthenticated Telnet Root RCE Vulnerability

A critical vulnerability, **CVE-2025-13184**, in the **TOTOLINK X5000R (AX1800)** home router allows an attacker with access to the device’s management interface—or physical access to the router—to enable **Telnet** without authentication and log in as **root** with no password. The flaw was confirmed in firmware version `V9.1.0u.6369_B20230113`, and earlier versions may also be affected. Publicly known exploitation can lead to full device compromise, arbitrary code execution, configuration tampering, traffic manipulation, exposure of sensitive network data, botnet enrollment, and lateral movement to other devices on the local network. No vendor patch was reported as available at the time of publication, prompting guidance to treat the X5000R as untrusted from an access-control perspective and avoid connecting it directly to the internet. Recommended mitigations include keeping the management panel inaccessible from the public internet, verifying network segmentation and cabling, replacing the firmware with an alternative such as **OpenWrt** where feasible, or removing and securely disposing of the device if the risk cannot be managed. A key indicator of compromise is **TCP port 23** being open on the router, suggesting Telnet has been enabled maliciously.

Mar 11, 2026

Critical Unauthenticated Remote Code Execution Vulnerability in TOTOLINK X6000R Routers

A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2025-52906 with a CVSS score of 9.3, has been discovered in TOTOLINK X6000R routers. This flaw allows attackers to execute arbitrary commands on affected devices without authentication, posing a severe risk to users of these widely deployed consumer networking products. The vulnerability is present in firmware version V9.4.0cu.1360_B20241207, which was released on March 28, 2025. In addition to CVE-2025-52906, two other significant vulnerabilities were identified in the same firmware: CVE-2025-52905, an argument injection flaw that can trigger denial-of-service (DoS) conditions, and CVE-2025-52907, a security bypass that could lead to persistent DoS or arbitrary file writes, with the potential for chained attacks resulting in RCE. The unauthenticated command injection vulnerability (CVE-2025-52906) is considered the most critical, as it enables attackers to compromise the device remotely and potentially use it as a foothold for further attacks on connected networks. Palo Alto Networks' Unit 42 team conducted a technical analysis of these vulnerabilities, detailing their root causes and demonstrating their impacts. The widespread use of TOTOLINK routers in consumer and small business environments amplifies the potential impact of these flaws. TOTOLINK has responded by releasing updated firmware to address the vulnerabilities, and users are strongly advised to apply these updates immediately to mitigate risk. Security solutions such as Palo Alto Networks' Next-Generation Firewall and Device Security offerings can help detect and block exploitation attempts. The vulnerabilities highlight the ongoing risks associated with IoT and consumer networking devices, which are often targeted due to their broad deployment and sometimes limited security controls. Attackers exploiting CVE-2025-52906 could gain full control over the router, intercept network traffic, or launch further attacks against internal or external targets. The technical details provided by researchers enable defenders to better understand the attack vectors and implement appropriate mitigations. Organizations and individuals using TOTOLINK X6000R routers should assess their exposure and ensure that all devices are updated to the latest firmware version. The incident underscores the importance of timely vulnerability disclosure and coordinated response between vendors and security researchers. Monitoring for signs of compromise and unusual network activity is recommended for all potentially affected environments. The discovery of these vulnerabilities serves as a reminder of the critical need for robust security practices in the management of network infrastructure devices.

Oct 2, 2025

Critical Command Injection Flaws Expose Totolink A8000RU Routers to Remote RCE

Three critical vulnerabilities, **CVE-2026-7121**, **CVE-2026-7122**, and **CVE-2026-7125**, were disclosed in the **Totolink A8000RU** router running firmware `7.1cu.643_b20200521`, all affecting the `/cgi-bin/cstecgi.cgi` CGI handler. The flaws are OS command injection issues in the `setWizardCfg`, `setUPnPCfg`, and `setWiFiEasyCfg` functions, where crafted input to the `wizard`, `enable`, and `merge` arguments can trigger command execution on the device. The vulnerabilities are mapped to **CWE-78** and **CWE-77** and were rated critical across **CVSS v2**, **CVSS v3.1**, and **CVSS v4.0** scoring schemes. All three issues are remotely exploitable over the network and require **no privileges** and **no user interaction**, creating a high-risk exposure for internet-accessible devices. Public exploit information has already been disclosed, with references including VulDB entries and a GitHub proof-of-concept, increasing the likelihood of near-term exploitation. The disclosures indicate that multiple administrative configuration paths in the router's web interface can be abused for remote code execution, making unpatched A8000RU systems a priority for immediate review and remediation.

Apr 27, 2026

TOTOLINK AX1800 Router Unauthenticated Telnet Root RCE Vulnerability

How this story unfolded

Reports highlight the flaw remains unpatched

Public technical details and exploit information become available

CVE-2025-13184 published for TOTOLINK X5000R router

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

TOTOLINK AX1800 Router Unauthenticated Telnet Root RCE Vulnerability

How this story unfolded

Reports highlight the flaw remains unpatched

Public technical details and exploit information become available

CVE-2025-13184 published for TOTOLINK X5000R router

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

TOTOLINK AX1800 Router Unauthenticated Telnet Root RCE Vulnerability

How this story unfolded

Reports highlight the flaw remains unpatched

Public technical details and exploit information become available

CVE-2025-13184 published for TOTOLINK X5000R router

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical TOTOLINK X5000R Flaw Enables Root Access and Remote Code Execution

Critical Unauthenticated Remote Code Execution Vulnerability in TOTOLINK X6000R Routers

Critical Command Injection Flaws Expose Totolink A8000RU Routers to Remote RCE

TOTOLINK AX1800 Router Unauthenticated Telnet Root RCE Vulnerability

How this story unfolded

Reports highlight the flaw remains unpatched

Public technical details and exploit information become available

CVE-2025-13184 published for TOTOLINK X5000R router

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical TOTOLINK X5000R Flaw Enables Root Access and Remote Code Execution

Critical Unauthenticated Remote Code Execution Vulnerability in TOTOLINK X6000R Routers

Critical Command Injection Flaws Expose Totolink A8000RU Routers to Remote RCE