CVE-2025-1829
Published: 02 March 2025
Summary
CVE-2025-1829 is a medium-severity Command Injection (CWE-77) vulnerability in Totolink X18 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by requiring validation of the mtkhnatEnable parameter in the vulnerable setMtknatCfg function of cstecgi.cgi.
Mitigates the vulnerability by mandating timely flaw remediation, including patching the command injection issue in the router firmware despite vendor inaction.
Limits damage from successful command injection by enforcing least privilege on processes handling the vulnerable CGI script, reducing impact of executed commands.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection vulnerability in public-facing CGI script (/cgi-bin/cstecgi.cgi) enables exploitation of public-facing applications (T1190) and direct execution of arbitrary Unix shell commands via unsanitized 'mtkhnatEnable' parameter passed to dosystem() (T1059.004).
NVD Description
A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been declared as critical. This vulnerability affects the function setMtknatCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mtkhnatEnable leads to os command injection. The attack can be initiated…
more
remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-1829 is a critical OS command injection vulnerability in the TOTOLINK X18 router running firmware version 9.1.0cu.2024_B20220329. The issue resides in the setMtknatCfg function within the /cgi-bin/cstecgi.cgi script, where manipulation of the mtkhnatEnable argument enables attackers to inject and execute arbitrary operating system commands. It is classified under CWE-77 and CWE-78, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), and was published on 2025-03-02.
The vulnerability can be exploited remotely by attackers who possess low privileges (PR:L), requiring network access with low attack complexity and no user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling command execution on the device to disrupt services, modify configurations, or exfiltrate minor data.
References including VulDB entries and a GitHub repository disclose the exploit publicly, noting it may be actively used, while the vendor TOTOLINK was contacted early but provided no response or patches as of the latest information. No official mitigations or firmware updates are detailed in the available advisories.
Details
- CWE(s)