Critical TOTOLINK X5000R Flaw Enables Root Access and Remote Code Execution

A critical vulnerability, CVE-2025-13184, in the TOTOLINK X5000R (AX1800) home router allows an attacker with access to the device’s management interface—or physical access to the router—to enable Telnet without authentication and log in as root with no password. The flaw was confirmed in firmware version V9.1.0u.6369_B20230113, and earlier versions may also be affected. Publicly known exploitation can lead to full device compromise, arbitrary code execution, configuration tampering, traffic manipulation, exposure of sensitive network data, botnet enrollment, and lateral movement to other devices on the local network.

No vendor patch was reported as available at the time of publication, prompting guidance to treat the X5000R as untrusted from an access-control perspective and avoid connecting it directly to the internet. Recommended mitigations include keeping the management panel inaccessible from the public internet, verifying network segmentation and cabling, replacing the firmware with an alternative such as OpenWrt where feasible, or removing and securely disposing of the device if the risk cannot be managed. A key indicator of compromise is TCP port 23 being open on the router, suggesting Telnet has been enabled maliciously.