Loading story…
A critical vulnerability, CVE-2025-13184, in the TOTOLINK X5000R (AX1800) home router allows an attacker with access to the device’s management interface—or physical access to the router—to enable Telnet without authentication and log in as root with no password. The flaw was confirmed in firmware version V9.1.0u.6369_B20230113, and earlier versions may also be affected. Publicly known exploitation can lead to full device compromise, arbitrary code execution, configuration tampering, traffic manipulation, exposure of sensitive network data, botnet enrollment, and lateral movement to other devices on the local network.
No vendor patch was reported as available at the time of publication, prompting guidance to treat the X5000R as untrusted from an access-control perspective and avoid connecting it directly to the internet. Recommended mitigations include keeping the management panel inaccessible from the public internet, verifying network segmentation and cabling, replacing the firmware with an alternative such as OpenWrt where feasible, or removing and securely disposing of the device if the risk cannot be managed. A key indicator of compromise is TCP port 23 being open on the router, suggesting Telnet has been enabled maliciously.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
By the time of disclosure, the exploitation method for CVE-2025-13184 was publicly known and no vendor patch was reported as available. CERT/CC and Traficom recommended treating the router as untrusted, avoiding internet exposure of the management panel, and considering mitigations such as network segmentation, alternative firmware, or device replacement.
A critical vulnerability, CVE-2025-13184, was publicly reported for the TOTOLINK X5000R (AX1800) router. The flaw allows an attacker with access to the management interface or physical access to enable Telnet without authentication and log in as root without a password, leading to possible full device compromise.
Firmware version V9.1.0u.6369_B20230113 was described as the latest available version as of October 2025, and it was confirmed to be affected by CVE-2025-13184. Earlier firmware versions were also considered potentially vulnerable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, tracked as CVE-2025-13184, has been discovered in the TOTOLINK AX1800 wireless router, allowing remote attackers to bypass authentication and enable the Telnet service via a crafted HTTP request to the `/cgi-bin/cstecgi.cgi?action=telnet` endpoint. This flaw permits unauthenticated users to gain root-level access to the device, enabling arbitrary command execution and full administrative control without requiring a password. The vulnerability affects at least the X5000R V9.1.0u.6369_B20230113 firmware and potentially earlier versions with similar implementations, and there is currently no official patch available. With root access, attackers can modify DNS settings, intercept network traffic, and use the compromised router as a foothold for further attacks within the local network. The CERT Coordination Center has issued an advisory warning of the severe implications, including the risk of lateral movement and persistent compromise if the router's management interface is exposed to the internet. The vulnerability is rated as critical (CVSS 9.8), and users are urged to restrict remote access and monitor for suspicious activity until a fix is released.
Jun 29, 2026
A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2025-52906 with a CVSS score of 9.3, has been discovered in TOTOLINK X6000R routers. This flaw allows attackers to execute arbitrary commands on affected devices without authentication, posing a severe risk to users of these widely deployed consumer networking products. The vulnerability is present in firmware version V9.4.0cu.1360_B20241207, which was released on March 28, 2025. In addition to CVE-2025-52906, two other significant vulnerabilities were identified in the same firmware: CVE-2025-52905, an argument injection flaw that can trigger denial-of-service (DoS) conditions, and CVE-2025-52907, a security bypass that could lead to persistent DoS or arbitrary file writes, with the potential for chained attacks resulting in RCE. The unauthenticated command injection vulnerability (CVE-2025-52906) is considered the most critical, as it enables attackers to compromise the device remotely and potentially use it as a foothold for further attacks on connected networks. Palo Alto Networks' Unit 42 team conducted a technical analysis of these vulnerabilities, detailing their root causes and demonstrating their impacts. The widespread use of TOTOLINK routers in consumer and small business environments amplifies the potential impact of these flaws. TOTOLINK has responded by releasing updated firmware to address the vulnerabilities, and users are strongly advised to apply these updates immediately to mitigate risk. Security solutions such as Palo Alto Networks' Next-Generation Firewall and Device Security offerings can help detect and block exploitation attempts. The vulnerabilities highlight the ongoing risks associated with IoT and consumer networking devices, which are often targeted due to their broad deployment and sometimes limited security controls. Attackers exploiting CVE-2025-52906 could gain full control over the router, intercept network traffic, or launch further attacks against internal or external targets. The technical details provided by researchers enable defenders to better understand the attack vectors and implement appropriate mitigations. Organizations and individuals using TOTOLINK X6000R routers should assess their exposure and ensure that all devices are updated to the latest firmware version. The incident underscores the importance of timely vulnerability disclosure and coordinated response between vendors and security researchers. Monitoring for signs of compromise and unusual network activity is recommended for all potentially affected environments. The discovery of these vulnerabilities serves as a reminder of the critical need for robust security practices in the management of network infrastructure devices.
Jun 29, 2026
Three critical vulnerabilities, **CVE-2026-7121**, **CVE-2026-7122**, and **CVE-2026-7125**, were disclosed in the **Totolink A8000RU** router running firmware `7.1cu.643_b20200521`, all affecting the `/cgi-bin/cstecgi.cgi` CGI handler. The flaws are OS command injection issues in the `setWizardCfg`, `setUPnPCfg`, and `setWiFiEasyCfg` functions, where crafted input to the `wizard`, `enable`, and `merge` arguments can trigger command execution on the device. The vulnerabilities are mapped to **CWE-78** and **CWE-77** and were rated critical across **CVSS v2**, **CVSS v3.1**, and **CVSS v4.0** scoring schemes. All three issues are remotely exploitable over the network and require **no privileges** and **no user interaction**, creating a high-risk exposure for internet-accessible devices. Public exploit information has already been disclosed, with references including VulDB entries and a GitHub proof-of-concept, increasing the likelihood of near-term exploitation. The disclosures indicate that multiple administrative configuration paths in the router's web interface can be abused for remote code execution, making unpatched A8000RU systems a priority for immediate review and remediation.
Jun 29, 2026