Junglewise Threat Intelligence

CVE-2025-13184: Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset

CVE-2025-13184 · Severity: critical · CVSS 9.8 · Published 2025-12-10

Technologies: TOTOLINK X5000r. Vendors: TOTOLINK.

Executive brief

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.

Affected products

  • TOTOLINK x5000r
  • TOTOLINK x5000r_firmware

Related threats