Cyber Posture

CVE-2025-13184

CriticalPublic PoC

Published: 10 December 2025

Published
10 December 2025
Modified
19 December 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0074 73.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for logical access, directly preventing the authentication bypass in cstecgi.cgi that enables unauthenticated Telnet activation.

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Limits permitted actions without identification or authentication to low-risk functions, prohibiting unauthenticated enablement of Telnet service via cstecgi.cgi.

CM-6 Configuration Settings good match
prevent

Mandates secure configuration settings that disable insecure services like Telnet by default and enforce authentication post-factory reset.

Security SummaryAI

CVE-2025-13184 is a critical authentication bypass vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting the TOTOLINK X5000R AX1800 router, specifically firmware version V9.1.0u.6369_B20230113 after factory reset. The issue resides in the cstecgi.cgi component, which allows unauthenticated attackers to enable the Telnet service. This leads to unauthenticated root login with a blank password, enabling arbitrary command execution. Earlier firmware versions sharing the same implementation may also be vulnerable. The vulnerability is classified under CWE-863 (Incorrect Authorization).

Any unauthenticated attacker with network access to the router can exploit this vulnerability with low complexity and no user interaction required. By sending crafted requests to cstecgi.cgi, the attacker enables Telnet, then connects via Telnet as root using a blank password to execute arbitrary commands. This grants full root-level control over the device, allowing high-impact confidentiality, integrity, and availability compromises such as data theft, persistent backdoor installation, or denial of service.

Mitigation details are provided in vendor and third-party advisories, including CERT Vulnerability Note VU#821724 (https://www.kb.cert.org/vuls/id/821724) and a technical analysis at https://hackingbydoing.wixsite.com/hackingbydoing/post/totolink-x5000r-ax1800-router-authentication-bypass.

Details

CWE(s)
CWE-863

Affected Products

totolink
x5000r firmware
9.1.0u.6369_b20230113

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

The vulnerability enables exploitation of a public-facing web application on the router (T1190) to bypass authentication, enable Telnet, and gain unauthenticated root CLI access for arbitrary command execution (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References