PT-2025-50325 · X5000R · X5000R

Published 2025-12-10 · Updated 2025-12-10 · CVE-2025-13184

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions X5000R versions prior to V9.1.0u.6369 B20230113

Description The device allows unauthenticated Telnet access through the cstecgi.cgi interface, bypassing authentication. This allows for unauthenticated root login with a blank password on a factory reset device. Successful exploitation results in arbitrary command execution.

Recommendations Apply updates to versions V9.1.0u.6369 B20230113 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-13184

Affected Products

X5000R

References · 7

• 🔥 https://hackingbydoing.wixsite.com/hackingbydoing/post/totolink-x5000r-ax1800-router-authentication-bypass · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13184 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13184 · Vendor Advisory
• https://kb.cert.org/vuls/id/821724 · Note
• https://t.me/CVEtracker/39359 · Telegram Post
• https://t.me/cveNotify/145324 · Telegram Post
• https://twitter.com/CVEnew/status/1998781313122275721 · Twitter Post