Skip to main content

CISA alerts on TOTOLINK AX1800 unauthenticated telnet flaw

Source Decision Insights Threat Desk Published December 9, 2025 Companies 1
Human View Machine View

373rd article in the last 90 days, one of 489 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues three ICS advisories on U-Boot, Festo LX, CCTV cameras (Dec 2025).

Companies mentioned

Best suited for

Seniority
Staff
Job function
Network / Network Engineer
Persona
Security Operations Leader
Decision stage
How to start
Adoption curve
Early Majority
Industry
Information Technology / Technology Hardware & Equipment / Communications Equipment / Computer Networking

Our classification, not the publisher's statement. Best suited for, not only for.

TOTOLINK AX1800 routers, including the X5000R model, contain a web-management flaw that can be triggered without authentication and may enable telnet, potentially permitting remote code execution with root-level privileges.

The vulnerability is tracked as CVE-2025-13184 and arises from missing authentication at the /cgi-bin/cstecgi.cgi?action=telnet endpoint; an unauthenticated Hypertext Transfer Protocol (HTTP) request to that endpoint may result in arbitrary command execution at the administrative level.

Reported impacts include full access to configuration and filesystems, with that level of access enabling modification of routing, including Domain Name System (DNS) routing, interception of traffic, and lateral movement across the Local Area Network (LAN). There is a potential for wide area (WAN) network access if router management or telnet becomes externally reachable.

The CERT/CC indicates it is currently unaware of a practical solution to this problem, and states that a firmware update is necessary for complete remediation.

Guidance in the advisory advises ensuring the web management interface is not exposed to the Wide Area Network (WAN) or any untrusted network and restricting administrative interface access to trusted management hosts only; treating the X5000R router as untrusted from a security boundary point of view and, where possible, placing it behind a separate firewall or router and avoiding its use as the primary edge device; and blocking or monitoring unexpected traffic to telnet (TCP port 23) on the device, noting that the sudden appearance of an open telnet service on the router is a strong indicator of exploitation.

Blog post, originally published by Laurie Tyzenhaus at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-alerts-on-totolink-ax1800-unauthenticated-telnet-flaw/",
        "name": "CISA alerts on TOTOLINK AX1800 unauthenticated telnet flaw",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-alerts-on-totolink-ax1800-unauthenticated-telnet-flaw/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Staff"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Network / Network Engineer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Technology Hardware & Equipment / Communications Equipment / Computer Networking"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:10:14-06:00",
    "datePublished": "2025-12-09T12:57:34-07:00",
    "description": "TOTOLINK AX1800 routers have an unauthenticated HTTP endpoint that can enable telnet and may allow remote code execution.",
    "headline": "CISA alerts on TOTOLINK AX1800 unauthenticated telnet flaw",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Laurie Tyzenhaus"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/821724"
    },
    "keywords": [
      "Authentication",
      "Domain Name System",
      "Local Area Network",
      "Router",
      "Wide Area Network"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-alerts-on-totolink-ax1800-unauthenticated-telnet-flaw/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages