60
CVE-2025-13184
Unauthenticated Telnet enablement to root on TOTOLINK X5000R
- CVSS 3.1
- 9.8 critical
- EPSS
- 20%p97
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
cstecgi.cgi on TOTOLINK X5000R firmware lets a remote, unauthenticated attacker turn on Telnet without credentials. On factory or reset units running V9.1.0u.6369_B20230113, that yields a root login with a blank password and arbitrary command execution. Earlier builds that share the same implementation may also be affected. No fixed release is named.
What to do: TOTOLINK has not listed a fixed build. Apply TOTOLINK's update for CVE-2025-13184 if one is published. No workaround is named.
| Product | Affected |
|---|---|
| totolink x5000r firmware | V9.1.0u.6369_B20230113; earlier versions with the same implementation may also be affected |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.
- Vendors
- totolink
- Products
- x5000r firmware
- Weakness
- CWE-863
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H