CVE-2025-61044

CriticalCVSS 9.8

Published: 01/10/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.02%

64th percentile - higher than 64% of all known CVEs

Summary

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function. The vulnerability allows execution of arbitrary commands.

Risk Assessment

An attacker can exploit the vulnerability to execute system commands on the device, potentially leading to network takeover. The risk is high due to remote exploitability.

Recommendation

Update TOTOLINK X18 firmware to the latest version if the vendor provides a fix. Restrict access to the device management interface to trusted networks.

Other vulnerabilities in TOTOLINK X18

CVE-2025-61045Critical
TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function. The vulnerability allows execution of arbitrary commands.

Original NVD description (English source)

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS