Loading story…
A critical zero-day vulnerability, tracked as CVE-2025-54322 and rated CVSS 10, has been discovered in XSpeeder networking devices, exposing approximately 70,000 systems worldwide to remote compromise. The flaw, identified by the research firm pwn.ai using AI-driven analysis, allows attackers to gain root access to affected devices without authentication by exploiting the chkid parameter in the vLogin.py file. XSpeeder, a Chinese vendor specializing in edge devices such as routers, SD-WAN appliances, and smart TV controllers, has reportedly not responded to disclosure attempts for over seven months, leaving the vulnerability unpatched and devices at risk.
The vulnerability enables attackers to execute arbitrary commands, potentially allowing them to monitor network traffic, steal sensitive data, or disrupt operations. Security researchers have highlighted the significance of this discovery as the first publicly disclosed agent-found, remotely exploitable 0-day, underscoring both the power of AI in vulnerability research and the risks posed by unresponsive vendors. Organizations using XSpeeder devices are urged to assess their exposure and implement network segmentation or other mitigations until a patch is made available, as the vendor has yet to address the issue despite repeated notifications.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On publication of the reports, researchers publicly disclosed CVE-2025-54322 as a maximum-severity CVSS 10.0 zero-day affecting XSpeeder networking gear. The disclosure also highlighted the case as a notable example of an AI agent uncovering a remotely exploitable vulnerability.
According to the disclosure, XSpeeder did not issue a patch or public advisory despite more than seven months of outreach from the researchers. This left CVE-2025-54322 unpatched and exposed as an active zero-day.
Research firm pwn.ai identified a critical unauthenticated remote code execution flaw, CVE-2025-54322, in XSpeeder networking devices using its AI-based tooling. The bug affects roughly 70,000 internet-exposed devices and can allow remote attackers to gain root access via the vLogin.py chkid parameter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **`CVE-2025-54322`** allows unauthenticated attackers to inject shell commands into an **XSpeeder SXZOS** management request and execute them with **root privileges**. Public reporting said the flaw is reachable over the network without authentication, creating a direct path to full device compromise through command injection in the management interface. Technical analysis and a proof of concept were published by pwn.ai, with follow-on reporting highlighting broad internet exposure of affected systems. The public **CVE** record corroborates the existence of the unauthenticated root command-injection issue, raising concern that exposed SXZOS deployments could be targeted for remote takeover if the vulnerable management service is accessible.
Jul 20, 2026
A critical vulnerability, **CVE-2025-13184**, in the **TOTOLINK X5000R (AX1800)** home router allows an attacker with access to the device’s management interface—or physical access to the router—to enable **Telnet** without authentication and log in as **root** with no password. The flaw was confirmed in firmware version `V9.1.0u.6369_B20230113`, and earlier versions may also be affected. Publicly known exploitation can lead to full device compromise, arbitrary code execution, configuration tampering, traffic manipulation, exposure of sensitive network data, botnet enrollment, and lateral movement to other devices on the local network. No vendor patch was reported as available at the time of publication, prompting guidance to treat the X5000R as untrusted from an access-control perspective and avoid connecting it directly to the internet. Recommended mitigations include keeping the management panel inaccessible from the public internet, verifying network segmentation and cabling, replacing the firmware with an alternative such as **OpenWrt** where feasible, or removing and securely disposing of the device if the risk cannot be managed. A key indicator of compromise is **TCP port 23** being open on the router, suggesting Telnet has been enabled maliciously.
Jun 29, 2026
A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2025-52906 with a CVSS score of 9.3, has been discovered in TOTOLINK X6000R routers. This flaw allows attackers to execute arbitrary commands on affected devices without authentication, posing a severe risk to users of these widely deployed consumer networking products. The vulnerability is present in firmware version V9.4.0cu.1360_B20241207, which was released on March 28, 2025. In addition to CVE-2025-52906, two other significant vulnerabilities were identified in the same firmware: CVE-2025-52905, an argument injection flaw that can trigger denial-of-service (DoS) conditions, and CVE-2025-52907, a security bypass that could lead to persistent DoS or arbitrary file writes, with the potential for chained attacks resulting in RCE. The unauthenticated command injection vulnerability (CVE-2025-52906) is considered the most critical, as it enables attackers to compromise the device remotely and potentially use it as a foothold for further attacks on connected networks. Palo Alto Networks' Unit 42 team conducted a technical analysis of these vulnerabilities, detailing their root causes and demonstrating their impacts. The widespread use of TOTOLINK routers in consumer and small business environments amplifies the potential impact of these flaws. TOTOLINK has responded by releasing updated firmware to address the vulnerabilities, and users are strongly advised to apply these updates immediately to mitigate risk. Security solutions such as Palo Alto Networks' Next-Generation Firewall and Device Security offerings can help detect and block exploitation attempts. The vulnerabilities highlight the ongoing risks associated with IoT and consumer networking devices, which are often targeted due to their broad deployment and sometimes limited security controls. Attackers exploiting CVE-2025-52906 could gain full control over the router, intercept network traffic, or launch further attacks against internal or external targets. The technical details provided by researchers enable defenders to better understand the attack vectors and implement appropriate mitigations. Organizations and individuals using TOTOLINK X6000R routers should assess their exposure and ensure that all devices are updated to the latest firmware version. The incident underscores the importance of timely vulnerability disclosure and coordinated response between vendors and security researchers. Monitoring for signs of compromise and unusual network activity is recommended for all potentially affected environments. The discovery of these vulnerabilities serves as a reminder of the critical need for robust security practices in the management of network infrastructure devices.
Jun 29, 2026