PT-2025-40255 · Totolink · Totolink X18

Ilovekeer · Published 2025-10-01 · Updated 2025-10-26 · CVE-2025-61045

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version V9.1.0cu.2053 B20230309

Description The setEasyMeshAgentCfg function in the TOTOLINK X18 router firmware does not properly sanitize data at the management level when processing the mac parameter. This can allow a remote attacker to execute arbitrary commands. The vulnerability is related to a command injection issue through the mac parameter within the setEasyMeshAgentCfg function.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the setEasyMeshAgentCfg function until a patch is available. Restrict access to the mac parameter in the affected function setEasyMeshAgentCfg() to minimize the risk of exploitation.

Exploit

Fix

RCE

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2025-12688

CVE-2025-61045

Affected Products

Totolink X18

References · 7

• 🔥 https://github.com/ilovekeer/IOT/blob/main/TOTOLINK/X18/setEasyMeshAgentCfg/1.md · Exploit
• https://bdu.fstec.ru/vul/2025-12688 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61045 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61045 · Vendor Advisory
• https://twitter.com/cr34t0r_Cyxac/status/1982280170922021061 · Twitter Post
• https://t.me/CVEtracker/33843 · Telegram Post
• https://twitter.com/CVEnew/status/1973411059747721279 · Twitter Post