CVE-2025-13184
Published: 10 December 2025
Summary
CVE-2025-13184 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-13184 is a critical authentication bypass vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting the TOTOLINK X5000R AX1800 router, specifically firmware version V9.1.0u.6369_B20230113 after factory reset. The issue resides in the cstecgi.cgi component, which allows unauthenticated attackers to enable the Telnet service. This leads to unauthenticated root login with a blank password, enabling arbitrary command execution. Earlier firmware versions sharing the same implementation may also be vulnerable. The vulnerability is classified under CWE-863 (Incorrect Authorization).
Any unauthenticated attacker with network access to the router can exploit this vulnerability with low complexity and no user interaction required. By sending crafted requests to cstecgi.cgi, the attacker enables Telnet, then connects via Telnet as root using a blank password to execute arbitrary commands. This grants full root-level control over the device, allowing high-impact confidentiality, integrity, and availability compromises such as data theft, persistent backdoor installation, or denial of service.
Mitigation details are provided in vendor and third-party advisories, including CERT Vulnerability Note VU#821724 (https://www.kb.cert.org/vuls/id/821724) and a technical analysis at https://hackingbydoing.wixsite.com/hackingbydoing/post/totolink-x5000r-ax1800-router-authentication-bypass.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202419
Vulnerability details
Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables exploitation of a public-facing web application on the router (T1190) to bypass authentication, enable Telnet, and gain unauthenticated root CLI access for arbitrary command execution (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access, directly preventing the authentication bypass in cstecgi.cgi that enables unauthenticated Telnet activation.
Limits permitted actions without identification or authentication to low-risk functions, prohibiting unauthenticated enablement of Telnet service via cstecgi.cgi.
Mandates secure configuration settings that disable insecure services like Telnet by default and enforce authentication post-factory reset.