CVE-2025-2096
📋 TL;DR
This critical vulnerability in TOTOLINK EX1800T routers allows remote attackers to execute arbitrary operating system commands through command injection in the setRebootScheCfg function. Attackers can exploit this to gain full control of affected devices. All users of TOTOLINK EX1800T routers with firmware version 9.1.0cu.2112_B20220316 are affected.
💻 Affected Systems
- TOTOLINK EX1800T
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, intercept all network traffic, or brick the device.
Likely Case
Attackers gain shell access to execute commands, potentially installing malware, creating backdoors, or using the device for botnet activities.
If Mitigated
Limited impact if device is behind strict firewall rules, not internet-facing, and network segmentation prevents lateral movement.
🎯 Exploit Status
Public exploit code is available on GitHub, making this easily weaponizable. The attack requires no authentication and can be executed remotely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.totolink.net/
Restart Required: Yes
Instructions:
1. Check TOTOLINK website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to the vulnerable web interface
Access router admin panel -> System -> Remote Management -> Disable
Restrict Web Interface Access
allLimit access to router admin interface to trusted IPs only
Access router admin panel -> Security -> Access Control -> Add trusted IP ranges
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious traffic to/from router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System -> Firmware Upgrade. If version is 9.1.0cu.2112_B20220316, device is vulnerable.Check Version:
curl -s http://router-ip/cgi-bin/cstecgi.cgi | grep versionVerify Fix Applied:
After firmware update, verify version has changed from 9.1.0cu.2112_B20220316. Test the setRebootScheCfg endpoint with safe payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/cstecgi.cgi with setRebootScheCfg
- Commands containing shell metacharacters in web logs
- Multiple failed authentication attempts followed by successful command execution
Network Indicators:
- Unusual outbound connections from router to external IPs
- Traffic patterns indicating reverse shells
- Unexpected port scans originating from router
SIEM Query:
source="router_logs" AND uri="/cgi-bin/cstecgi.cgi" AND (method="POST" OR params CONTAINS "setRebootScheCfg")🔗 References
- https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/OS%20Command%20Injection%2004%20setRebootScheCfg-_mode.md
- https://vuldb.com/?ctiid.298954
- https://vuldb.com/?id.298954
- https://vuldb.com/?submit.515322
- https://www.totolink.net/
- https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/OS%20Command%20Injection%2004%20setRebootScheCfg-_mode.md
