CVE-2025-2096
Published: 07 March 2025
Summary
CVE-2025-2096 is a medium-severity Command Injection (CWE-77) vulnerability in Totolink Ex1800T Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A critical OS command injection vulnerability exists in the TOTOLINK EX1800T wireless router running firmware version 9.1.0cu.2112_B20220316. The flaw resides in the setRebootScheCfg function within /cgi-bin/cstecgi.cgi, where unsanitized input to the mode, week, minute, and recHour parameters allows arbitrary command execution. It is tracked as CVE-2025-2096, carries a CVSS v4 score of 5.3, and is associated with CWE-77 and CWE-78.
An authenticated remote attacker can supply crafted HTTP requests to the CGI endpoint and execute operating-system commands on the device. Because the attack requires only low-privileged credentials and no user interaction, an adversary who obtains or guesses valid administrative access can leverage the injection to alter device behavior, exfiltrate configuration data, or pivot further into the network.
Public exploit code has been released, and the vulnerability is listed on multiple tracking platforms, yet the current EPSS score remains low at 0.0395 with a peak of only 0.0422, indicating limited observed exploitation interest to date. No vendor advisory or firmware update addressing the issue is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7495
Vulnerability details
A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mode/week/minute/recHour leads to os command injection. The attack can be initiated remotely. The exploit…
more
has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection in the router's public-facing web CGI interface enables exploitation of public-facing applications (T1190) and execution of arbitrary Unix shell commands on the embedded Linux-based device (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Prevents OS command injection by requiring validation of untrusted inputs to the setRebootScheCfg function parameters such as mode, week, minute, and recHour.
Directly mitigates the vulnerability through identification, reporting, and correction of the command injection flaw in the /cgi-bin/cstecgi.cgi file.
Reduces impact of injected commands by enforcing least privilege on low-privilege accounts accessing the vulnerable CGI endpoint.