CVE-2025-29209

Deeper analysis

TOTOLINK X18 firmware version 9.1.0cu.2024_B20220329 contains a command-injection vulnerability (CWE-77) in the sub_41105C function of cstecgi.cgi. Unauthenticated attackers can supply arbitrary input to the enable parameter and cause the device to execute operating-system commands without any prior authentication or user interaction. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and full impact on confidentiality, integrity, and availability.

Because the affected CGI endpoint is reachable over the network and requires no credentials, any remote adversary can exploit the issue to obtain a root shell on the router. Successful exploitation grants complete control of the device, enabling traffic interception, persistence, or use as an attack pivot inside the local network.

Public references consist of a technical write-up hosted on GitHub that demonstrates the injection vector; no vendor advisory or firmware patch is referenced in the available sources. The EPSS score rose from a low baseline to a peak of 0.0158 before receding to its current value of 0.0044, indicating a temporary increase in exploitation interest after disclosure.