CVE-2025-2095
Published: 07 March 2025
Summary
CVE-2025-2095 is a medium-severity Command Injection (CWE-77) vulnerability in Totolink Ex1800T Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by requiring validation of the 'ip' argument in setDmzCfg to ensure it conforms to expected IP formats without shell metacharacters.
Addresses the specific flaw in TOTOLINK EX1800T firmware by requiring timely remediation through vendor patches or updates.
Limits damage from injected commands by enforcing least privilege on the cgi-bin process handling setDmzCfg, reducing potential impacts to C:L/I:L/A:L.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated OS command injection via public-facing web CGI (setDmzCfg ip parameter) enables exploitation of public-facing application (T1190), indirect command execution through the web interface (T1202), and command execution via Unix shell (T1059.004) or network device CLI (T1059.008) on the router.
NVD Description
A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to initiate the attack remotely.…
more
The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2095 is a critical vulnerability involving OS command injection in the TOTOLINK EX1800T router running firmware version 9.1.0cu.2112_B20220316. The issue resides in the setDmzCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the "ip" argument enables arbitrary command execution on the underlying operating system. Classified under CWE-77 and CWE-78, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
A remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows injection and execution of OS commands, potentially resulting in limited impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification of system settings, or disruption of router services.
Advisories from VulDB detail the vulnerability (CTI ID 298953) and note public disclosure of an exploit via a GitHub repository demonstrating the command injection in the setDmzCfg "ip" parameter. The vendor's site at totolink.net is referenced, but no specific patches or mitigations are outlined in available sources; practitioners should monitor for firmware updates and restrict access to the affected CGI endpoint.
The exploit has been publicly disclosed and may be actively used, increasing the risk for unpatched TOTOLINK EX1800T devices exposed to the internet.
Details
- CWE(s)