Cyber Posture

CVE-2025-61045

CriticalPublic PoCRCE

Published: 01 October 2025

Published
01 October 2025
Modified
21 October 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0287 86.4th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-61045 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink X18 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mandates validation of the unsanitized mac parameter in setEasyMeshAgentCfg to block command injection.

prevent

Requires timely remediation of the command injection flaw via firmware patching.

prevent

Enforces boundary protection to block unauthenticated remote requests to the vulnerable endpoint.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

Command injection via web parameter in router's EasyMesh configuration enables exploitation of public-facing application (T1190), remote service exploitation (T1210), and arbitrary Unix shell command execution (T1059.004).

NVD Description

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function.

Deeper analysisAI

CVE-2025-61045 is a command injection vulnerability (CWE-77, CWE-78) affecting the TOTOLINK X18 router running firmware version V9.1.0cu.2053_B20230309. The flaw resides in the setEasyMeshAgentCfg function, where the mac parameter fails to properly sanitize user input, allowing attackers to inject and execute arbitrary operating system commands. With a CVSS v3.1 base score of 9.8 (Critical), it enables network-accessible exploitation with low complexity and no authentication or user interaction required.

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted request to the affected endpoint over the network. Successful exploitation grants high-impact remote code execution, compromising confidentiality, integrity, and availability (C:H/I:H/A:H) on the targeted device, potentially leading to full control over the router, data theft, or use as a pivot for further network attacks.

Mitigation details and proof-of-concept exploitation information are available in the referenced advisory at https://github.com/ilovekeer/IOT/blob/main/TOTOLINK/X18/setEasyMeshAgentCfg/1.md. Security practitioners should check for firmware updates from TOTOLINK and apply network segmentation or firewall rules to block unauthorized access to the affected function until patched.

Details

CWE(s)

Affected Products

totolink
x18 firmware
9.1.0cu.2053_b20230309

CVEs Like This One

CVE-2025-1829Same product: Totolink X18
CVE-2025-1339Same product: Totolink X18
CVE-2025-61044Same product: Totolink X18
CVE-2025-1340Same product: Totolink X18
CVE-2026-4611Same vendor: Totolink
CVE-2025-2096Same vendor: Totolink
CVE-2026-3301Same vendor: Totolink
CVE-2025-2094Same vendor: Totolink
CVE-2025-14586Same vendor: Totolink
CVE-2025-2095Same vendor: Totolink

References