What is the CVSS score of CVE-2025-13184?

CVE-2025-13184 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 11.3%.

Which versions of TOTOLINK X5000R are affected by CVE-2025-13184?

TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B20230113 contain a critical, fully unauthenticated remote code execution flaw that allows anyone who can reach the device's web…

Is there a public PoC exploit available for CVE-2025-13184?

Yes, a public proof-of-concept exploit is available for CVE-2025-13184. Prioritise patching immediately. EPSS: 11.3%.

How to fix or mitigate CVE-2025-13184?

Within 24 hours: inventory every TOTOLINK X5000R AX1800 and confirm firmware version V9.1.0u.6369_B20230113; immediately block inbound access to the router's web management interface (HTTP/HTTPS) and Telnet (TCP/23) from the WAN and any untrusted network via upstream firewall or ISP-side filtering; disable remote/WAN management on the device; change the root/admin password from blank on any factory-reset unit; and add IDS/IPS or SIEM detections for requests to /cstecgi.cgi and for Telnet logins from unexpected sources. Within 7 days: for any router that cannot be fully isolated, replace it or take it out of service, or move management onto a dedicated, access-controlled management VLAN restricted to known admin hosts with 802.1X or IP allow-listing; force device logging to a central collector and review the last 90 days of logs for signs of prior exploitation; rotate any credentials, VPN keys, or pre-shared secrets that transited or were stored on these devices; and open a case with TOTOLINK to obtain a fix timeline. Within 30 days: complete migration of all remaining X5000R AX1800 units to a supported model or vendor with an active security response program, verify no device still runs the affected firmware build, and document the compensating controls as a formal exception until vendor remediation is confirmed.

TOTOLINK X5000R CVE-2025-13184

CRITICAL

Incorrect Authorization (CWE-863)

2025-12-10 cret@cert.org

Authentication Bypass X5000r Firmware Router TOTOLINK

9.8

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote, unauthenticated, low-complexity authorization bypass yielding root command execution gives PR:N/UI:N and full C/I/A impact on the single device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 25, 2026 - 23:40 vuln.today

tag: Router added

Metadata Corrected

Sep 25, 2026 - 23:40 vuln.today

tag: TOTOLINK added

Analysis Generated

Sep 25, 2026 - 23:39 vuln.today

CVE Published

Dec 10, 2025 - 13:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.

AnalysisAI

Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B20230113 by abusing an authorization bypass in the cstecgi.cgi endpoint, and then log in as root using a blank password on factory-reset devices, yielding arbitrary command execution. Publicly available exploit code exists (a detailed write-up is referenced by NVD), and EPSS places this at roughly 11.28% (96th percentile), indicating elevated real-world interest, though there is no CISA KEV confirmation of active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the bypass is fully unauthenticated and requires no user interaction; risk is highest where the router's web management interface is reachable from the WAN or an untrusted network.

Technical ContextAI

The root issue is CWE-863 (Incorrect Authorization): the cstecgi.cgi CGI handler on the TOTOLINK X5000R AX1800 router firmware exposes functionality - specifically the ability to enable the Telnet service - without enforcing the authentication/authorization checks that should gate it. Because the handler fails to validate that a request originates from an authenticated administrative session, a remote, unauthenticated client can invoke it directly over HTTP and turn on the Telnet daemon. Combined with the factory/reset configuration, which leaves the root account with a blank password, this turns the authorization bypass into a full unauthenticated root shell and arbitrary command execution on the device. The affected artifact per the CPE is totolink:x5000r_firmware:9.1.0u.6369_b20230113, i.e. the router's firmware image, and the advisory notes that earlier firmware releases sharing the same cstecgi.cgi implementation may be affected as well. CERT/CC coordinated disclosure (KB CERT VU#821724) and an independent researcher write-up document the technique, and the NVD vector AV:N/AC:L/PR:N/UI:N confirms the pre-auth nature of the bypass.

RemediationAI

No vendor-released patch is identified in the available data at time of analysis, so remediation must rely on compensating controls. The most effective step is to eliminate reachability: disable remote/WAN administration and ensure the router's web management interface is not exposed to the internet, restricting it to a trusted LAN or dedicated management VLAN (trade-off: you lose convenient off-site administration). Disable Telnet explicitly if the firmware permits it, and set a strong, non-blank root/admin password immediately after any factory reset or firmware upgrade, since the unauthenticated root login depends on the blank-password factory state - note this blocks only the final login step and does not stop the authorization bypass itself from enabling Telnet. Monitor or block outbound/inbound TCP port 23 and audit for unexpected Telnet enablement. Consult the CERT/CC note (https://www.kb.cert.org/vuls/id/821724) and the researcher write-up (https://hackingbydoing.wixsite.com/hackingbydoing/post/totolink-x5000r-ax1800-router-authentication-bypass) for technical detail, and check with TOTOLINK for an updated firmware release before assuming any specific version is fixed.