Unpatched TOTOLINK AX1800 Router Flaw Allows Unauthenticated Telnet & Root RCE

A critical security vulnerability has been uncovered in the popular TOTOLINK AX1800 wireless router, a device widely used in small businesses and home offices. The flaw, which currently has no official patch, allows remote attackers to bypass authentication entirely and seize full administrative control of the device with a single HTTP request.

The CERT Coordination Center (CERT/CC) released a vulnerability note detailing the issue, tracking it as CVE-2025-13184.

The vulnerability lies in how the router handles management requests. Specifically, the device fails to authenticate commands sent to the /cgi-bin/cstecgi.cgi?action=telnet endpoint. This oversight allows an attacker to silently enable the Telnet service—a remote command protocol—without ever needing a password.

According to the advisory, “An unauthenticated HTTP request can enable telnet which may lead to remote code execution with root-level privileges”.

Once Telnet is active, the attacker can log in and execute arbitrary commands with the highest possible privileges on the device (root).

The implications of this breach are severe. With root access, the router essentially becomes a listening post for the attacker. They can modify DNS routing to redirect users to phishing sites, intercept sensitive traffic, or use the compromised router as a beachhead to launch attacks against other devices on the local network.

“The impact options include full access to configuration and filesystems,” the note warns. “This level of access would provide an attacker the capability to modify routing DNS routing, intercept traffic, and achieve lateral movement across the local area network”.

Furthermore, if the router’s web management interface is exposed to the internet—a common misconfiguration—the risk escalates to a wide-area network (WAN) compromise. “There is a potential for wide area (WAN) network access if router management or telnet becomes externally reachable”.

Perhaps most concerning is the current lack of a fix from the manufacturer. “The CERT/CC is currently unaware of a practical solution to this problem,” the advisory states. “For complete remediation, a firmware update is necessary”.

Until a firmware update is released, administrators are urged to lock down their devices immediately. CERT/CC recommends the following defensive measures:

• Block WAN Access: Ensure the web management interface is not exposed to the internet. Restrict administrative access solely to trusted internal hosts.
• Isolate the Device: Treat the router as “untrusted from a security boundary point of view.” If possible, place it behind a separate firewall to limit its ability to harm the rest of the network.
• Watch for Telnet: Monitor network traffic for unexpected activity on TCP port 23. As the report notes, “The sudden appearance of an open telnet service on the router is a strong indicator of exploitation”.

Related Posts:

• TP-Link Router Flaw CVE-2023-28760 Allows Root RCE via LAN, PoC Available
• Critical Flaw CVE-2025-52906 (CVSS 9.3) Allows Unauthenticated RCE on TOTOLINK X6000R Routers
• 0-Click NTLM Authentication Bypass Hits Microsoft Telnet Server, PoC Releases, No Patch
• RustoBot Botnet Exploits Router Flaws in Sophisticated Attacks
• Google Launches Cloud WAN for Secure, High-Performance Enterprise Networking