Cyber Posture

CVE-2025-61045

CriticalPublic PoC

Published: 01 October 2025

Published
01 October 2025
Modified
21 October 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0291 86.4th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Security Summary

CVE-2025-61045 is a command injection vulnerability (CWE-77, CWE-78) affecting the TOTOLINK X18 router running firmware version V9.1.0cu.2053_B20230309. The flaw resides in the setEasyMeshAgentCfg function, where the mac parameter fails to properly sanitize user input, allowing attackers to inject and execute arbitrary operating system commands. With a CVSS v3.1 base score of 9.8 (Critical), it enables network-accessible exploitation with low complexity and no authentication or user interaction required.

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted request to the affected endpoint over the network. Successful exploitation grants high-impact remote code execution, compromising confidentiality, integrity, and availability (C:H/I:H/A:H) on the targeted device, potentially leading to full control over the router, data theft, or use as a pivot for further network attacks.

Mitigation details and proof-of-concept exploitation information are available in the referenced advisory at https://github.com/ilovekeer/IOT/blob/main/TOTOLINK/X18/setEasyMeshAgentCfg/1.md. Security practitioners should check for firmware updates from TOTOLINK and apply network segmentation or firewall rules to block unauthorized access to the affected function until patched.

Details

CWE(s)
CWE-77CWE-78

Affected Products

totolink
x18 firmware
9.1.0cu.2053_b20230309

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

Command injection via web parameter in router's EasyMesh configuration enables exploitation of public-facing application (T1190), remote service exploitation (T1210), and arbitrary Unix shell command execution (T1059.004).

References