CVE-2025-13184: Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 20.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-10 · updated 2026-09-25
Weakness: CWE-863

Description

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.

Affected products

TOTOLINK X5000R: 9.1.0u.6369_b20230113

References

https://hackingbydoing.wixsite.com/hackingbydoing/post/totolink-x5000r-ax1800-router-authentication-bypass
https://www.kb.cert.org/vuls/id/821724

Get alerted when CVE-2025-13184 or the next vulnerability affects your stack