External risk intelligence

Totolink X5000R Authentication Bypass via Telnet Enablement

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-13184

The vulnerability affects a home/small office router and involves the enablement of Telnet, a remote management protocol. Because this product is an internet edge device designed to provide network connectivity, the management interface or services exposed by the device are typically reachable from the internet, especially when misconfigured or left with default settings.

Totolink X5000r Firmware

9.1.0u.6369_b20230113

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a router product that allows unauthenticated attackers to gain root access with no password, enabling them to execute arbitrary commands. This exposure occurs through an unauthenticated Telnet enablement feature in a specific router model's firmware. The main concern is confirming relevance and exposure due to the potential for unauthorized control over network devices.

Unauthenticated root access grants full control.
Affects internet-facing router, easy to exploit.
Confirm device exposure; remote command execution risk.

Attack Path

How an attacker could exploit the issue

An attacker can leverage this vulnerability by accessing a vulnerable router's web interface. By exploiting a flaw in the `cstecgi.cgi` component, they can enable Telnet access without needing any credentials. Once Telnet is enabled, the attacker can log in as the root user with a blank password, allowing them to execute arbitrary commands on the device.

No authentication required.
Enable Telnet via web interface.
Unauthenticated root access and command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to gain root-level access to the affected device, enabling arbitrary command execution without any user interaction. This could occur when the Telnet service is enabled and accessible externally.

Device root access.
Telnet service exposed externally.
Arbitrary command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts network infrastructure, making the Network or Security team the likely first responders. Their initial action should be to locate all instances of the affected device, determine their network exposure, and identify the business criticality and responsible owner. Subsequent remediation planning will depend on this assessment.

Network/Security team owns the issue.
Verify device exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Totolink X5000R?

The Totolink X5000R is a wireless router designed for home and small office environments. It acts as a gateway that connects local devices to the internet. The firmware version 9.1.0u.6369_B20230113 manages the device's networking, firewall, and administrative functions, including the web-based management interface.

What does CVE-2025-13184 mean?

This CVE describes an authentication bypass vulnerability categorized as CWE-863. It means the software fails to properly verify a user's identity before allowing restricted actions. In this case, the router allows an unauthorized person to change settings and gain full administrative control without ever providing a password.

How is this vulnerability triggered?

An attacker triggers the flaw by sending a specifically crafted request to the router's cstecgi.cgi component via the web interface. This action forcibly enables the Telnet service. It is important to note that simply having the router powered on does not trigger the bug; the attacker must actively target the web interface to enable and then access the Telnet service.

Is my device at risk?

According to Halo Surface Signal, this vulnerability is highly relevant for home and small office routers because they often act as internet-facing edge devices. If your router's management interface is reachable from the public internet, it is at higher risk. Devices kept strictly on an internal, protected network have a smaller attack surface, but the risk remains if the device configuration is mismanaged.

What should I do if I use this router?

If you are responsible for this equipment, begin by creating an inventory of all instances of the Totolink X5000R in your environment. Next, verify which devices have management interfaces exposed to the network or internet. Once identified, restrict access to the web interface to authorized users only and prepare for firmware updates or other hardening measures as defined by your security team.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.