Cyber Posture

CVE-2025-2095

MediumPublic PoC

Published: 07 March 2025

Published
07 March 2025
Modified
03 April 2025
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0295 86.5th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

Security Summary

CVE-2025-2095 is a critical vulnerability involving OS command injection in the TOTOLINK EX1800T router running firmware version 9.1.0cu.2112_B20220316. The issue resides in the setDmzCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the "ip" argument enables arbitrary command execution on the underlying operating system. Classified under CWE-77 and CWE-78, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

A remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows injection and execution of OS commands, potentially resulting in limited impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification of system settings, or disruption of router services.

Advisories from VulDB detail the vulnerability (CTI ID 298953) and note public disclosure of an exploit via a GitHub repository demonstrating the command injection in the setDmzCfg "ip" parameter. The vendor's site at totolink.net is referenced, but no specific patches or mitigations are outlined in available sources; practitioners should monitor for firmware updates and restrict access to the affected CGI endpoint.

The exploit has been publicly disclosed and may be actively used, increasing the risk for unpatched TOTOLINK EX1800T devices exposed to the internet.

Details

CWE(s)
CWE-77CWE-78

Affected Products

totolink
ex1800t firmware
9.1.0cu.2112_b20220316

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
attack.mitre.org →
Why these techniques?

Unauthenticated OS command injection via public-facing web CGI (setDmzCfg ip parameter) enables exploitation of public-facing application (T1190), indirect command execution through the web interface (T1202), and command execution via Unix shell (T1059.004) or network device CLI (T1059.008) on the router.

References