CVE-2025-2094
Published: 07 March 2025
Summary
CVE-2025-2094 is a medium-severity Command Injection (CWE-77) vulnerability in Totolink Ex1800T Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by validating and sanitizing the apcliKey/key input to the setWiFiExtenderConfig function in the CGI script.
Remediates the specific command injection vulnerability in the TOTOLINK router firmware through timely flaw identification, reporting, and patching.
Limits the scope and impact of injected OS commands by enforcing least privilege on the low-privilege process handling the vulnerable endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing CGI endpoint (setWiFiExtenderConfig) directly enables T1190 via crafted web requests and T1059.004 for arbitrary Unix shell command execution on the router firmware.
NVD Description
A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. It has been rated as critical. Affected by this issue is the function setWiFiExtenderConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument apcliKey/key leads to os command injection. The attack may…
more
be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2094 is an OS command injection vulnerability in the TOTOLINK EX1800T router firmware version 9.1.0cu.2112_B20220316. The flaw affects the setWiFiExtenderConfig function in the /cgi-bin/cstecgi.cgi file, where manipulation of the apcliKey/key argument enables command injection. Rated as critical with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), it maps to CWE-77 and CWE-78.
An attacker with low privileges can exploit this remotely by sending a crafted request to the vulnerable endpoint, injecting and executing arbitrary OS commands on the device. This grants limited impacts on confidentiality, integrity, and availability, such as reading or modifying restricted data, altering system behavior, or disrupting services to a minor degree.
Advisories referenced in VULDB entries (ctiid.298952, id.298952, submit.515319) detail the issue and its remote exploitability, while a GitHub repository provides a disclosed proof-of-concept exploit targeting the apcliKey parameter in setWiFiExtenderConfig. The vendor site at totolink.net is listed but offers no specific patch or mitigation details in the available references.
The exploit has been publicly disclosed and may be used against affected devices.
Details
- CWE(s)