Loading story…
A critical unpatched vulnerability, tracked as CVE-2025-65606, has been disclosed in the TOTOLINK EX200 wireless range extender. The flaw resides in the device's firmware-upload error-handling logic, which, when triggered by a remote authenticated attacker using specially crafted firmware files, causes the device to start an unauthenticated root-level telnet service. This unintended telnet interface grants full system access, allowing attackers to manipulate configurations, execute arbitrary commands, and establish persistent control over the device. The vulnerability requires the attacker to have prior access to the web management interface, but once exploited, it bypasses all authentication for root access.
The TOTOLINK EX200 is no longer actively maintained, and no patches have been released to address this issue. Security experts and CERT/CC recommend that users restrict administrative access to trusted networks, prevent unauthorized access to the management interface, monitor for unusual activity, and consider upgrading to a supported device. The last firmware update for the EX200 was released in February 2023, and the product is now considered end-of-life, increasing the risk for users who continue to operate it without mitigation measures.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On January 6, 2026, CERT/CC published Vulnerability Note VU#295169 warning that CVE-2025-65606 affects the end-of-life TOTOLINK EX200. The advisory said no patch was available and recommended restricting management access, monitoring for telnet activity, and replacing the device.
Researcher Leandro Kogan identified and reported CVE-2025-65606, a flaw in the EX200 firmware-upload logic that can start an unauthenticated root-level telnet service after processing a malformed firmware file. The issue allows a remote authenticated attacker to gain full control of the device.
The TOTOLINK EX200 wireless range extender last received a firmware update in February 2023. Later reporting identified the model as end-of-life and no longer actively maintained.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcesecurityonline.info
Open sourcethecyberexpress.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, **CVE-2025-13184**, in the **TOTOLINK X5000R (AX1800)** home router allows an attacker with access to the device’s management interface—or physical access to the router—to enable **Telnet** without authentication and log in as **root** with no password. The flaw was confirmed in firmware version `V9.1.0u.6369_B20230113`, and earlier versions may also be affected. Publicly known exploitation can lead to full device compromise, arbitrary code execution, configuration tampering, traffic manipulation, exposure of sensitive network data, botnet enrollment, and lateral movement to other devices on the local network. No vendor patch was reported as available at the time of publication, prompting guidance to treat the X5000R as untrusted from an access-control perspective and avoid connecting it directly to the internet. Recommended mitigations include keeping the management panel inaccessible from the public internet, verifying network segmentation and cabling, replacing the firmware with an alternative such as **OpenWrt** where feasible, or removing and securely disposing of the device if the risk cannot be managed. A key indicator of compromise is **TCP port 23** being open on the router, suggesting Telnet has been enabled maliciously.
Jun 29, 2026
A critical vulnerability, tracked as CVE-2025-13184, has been discovered in the TOTOLINK AX1800 wireless router, allowing remote attackers to bypass authentication and enable the Telnet service via a crafted HTTP request to the `/cgi-bin/cstecgi.cgi?action=telnet` endpoint. This flaw permits unauthenticated users to gain root-level access to the device, enabling arbitrary command execution and full administrative control without requiring a password. The vulnerability affects at least the X5000R V9.1.0u.6369_B20230113 firmware and potentially earlier versions with similar implementations, and there is currently no official patch available. With root access, attackers can modify DNS settings, intercept network traffic, and use the compromised router as a foothold for further attacks within the local network. The CERT Coordination Center has issued an advisory warning of the severe implications, including the risk of lateral movement and persistent compromise if the router's management interface is exposed to the internet. The vulnerability is rated as critical (CVSS 9.8), and users are urged to restrict remote access and monitor for suspicious activity until a fix is released.
Jun 29, 2026
A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2025-52906 with a CVSS score of 9.3, has been discovered in TOTOLINK X6000R routers. This flaw allows attackers to execute arbitrary commands on affected devices without authentication, posing a severe risk to users of these widely deployed consumer networking products. The vulnerability is present in firmware version V9.4.0cu.1360_B20241207, which was released on March 28, 2025. In addition to CVE-2025-52906, two other significant vulnerabilities were identified in the same firmware: CVE-2025-52905, an argument injection flaw that can trigger denial-of-service (DoS) conditions, and CVE-2025-52907, a security bypass that could lead to persistent DoS or arbitrary file writes, with the potential for chained attacks resulting in RCE. The unauthenticated command injection vulnerability (CVE-2025-52906) is considered the most critical, as it enables attackers to compromise the device remotely and potentially use it as a foothold for further attacks on connected networks. Palo Alto Networks' Unit 42 team conducted a technical analysis of these vulnerabilities, detailing their root causes and demonstrating their impacts. The widespread use of TOTOLINK routers in consumer and small business environments amplifies the potential impact of these flaws. TOTOLINK has responded by releasing updated firmware to address the vulnerabilities, and users are strongly advised to apply these updates immediately to mitigate risk. Security solutions such as Palo Alto Networks' Next-Generation Firewall and Device Security offerings can help detect and block exploitation attempts. The vulnerabilities highlight the ongoing risks associated with IoT and consumer networking devices, which are often targeted due to their broad deployment and sometimes limited security controls. Attackers exploiting CVE-2025-52906 could gain full control over the router, intercept network traffic, or launch further attacks against internal or external targets. The technical details provided by researchers enable defenders to better understand the attack vectors and implement appropriate mitigations. Organizations and individuals using TOTOLINK X6000R routers should assess their exposure and ensure that all devices are updated to the latest firmware version. The incident underscores the importance of timely vulnerability disclosure and coordinated response between vendors and security researchers. Monitoring for signs of compromise and unusual network activity is recommended for all potentially affected environments. The discovery of these vulnerabilities serves as a reminder of the critical need for robust security practices in the management of network infrastructure devices.
Jun 29, 2026