📦 X18 Firmware

by Totolink

🔍 What is X18 Firmware?

Description coming soon...

🛡️ Security Overview

Click on a severity to filter vulnerabilities

⚠️ Known Vulnerabilities

CVE-2025-61044

CRITICAL CVSS 9.8 Oct 1, 2025

This CVE describes a command injection vulnerability in TOTOLINK X18 routers that allows attackers to execute arbitrary commands on the device. The vulnerability exists in the setEasyMeshAgentCfg func...

CVE-2025-61045

CRITICAL CVSS 9.8 Oct 1, 2025

This vulnerability allows remote attackers to execute arbitrary commands on TOTOLINK X18 routers by injecting malicious code into the mac parameter of the setEasyMeshAgentCfg function. Attackers can g...

CVE-2025-29064

CRITICAL CVSS 9.8 Apr 3, 2025

This vulnerability allows remote attackers to execute arbitrary operating system commands on TOTOLINK X18 routers via the cstecgi.cgi interface. Attackers can gain full control of affected devices wit...

CVE-2023-29800

CRITICAL CVSS 9.8 Apr 14, 2023

This vulnerability allows remote attackers to execute arbitrary commands on TOTOLINK X18 routers by injecting malicious commands into the FileName parameter during firmware upload. Attackers can gain ...

CVE-2023-29802

CRITICAL CVSS 9.8 Apr 14, 2023

This CVE describes a command injection vulnerability in TOTOLINK X18 routers that allows attackers to execute arbitrary commands on the device by manipulating the ip parameter in the setDiagnosisCfg f...

CVE-2023-29798

CRITICAL CVSS 9.8 Apr 14, 2023

This vulnerability allows remote attackers to execute arbitrary commands on TOTOLINK X18 routers by injecting malicious commands into the setTracerouteCfg function's command parameter. Attackers can g...

CVE-2025-1340

HIGH CVSS 8.8 Feb 16, 2025

A critical stack-based buffer overflow vulnerability in TOTOLINK X18 routers allows remote attackers to execute arbitrary code by sending specially crafted strings to the setPasswordCfg function. This...

CVE-2025-1339

MEDIUM CVSS 6.3 Feb 16, 2025

This critical vulnerability in TOTOLINK X18 routers allows remote attackers to execute arbitrary operating system commands by manipulating the 'enable' parameter in the setL2tpdConfig function. Attack...