Skip to content
OpenAdvisories
Critical · 9.8 CVE-2025-13184 EUVD-2025-202419GHSA-xr55-5xvm-9rw7

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password

Published Dec 10, 2025 · Updated Dec 10, 2025 · Assigned by certcc

Vendor: Toto Link Product: X5000R's (AX1800 router)

Description

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.

Affected products

VendorProductAffectedFixed
Toto Link X5000R's (AX1800 router) < V9.1.0u.6369_B20230113 V9.1.0u.6369_B20230113

References