Skip to main content

CISA issues advisory on TOTOLINK EX200 unauthenticated root telnet

Source Decision Insights Threat Desk Published January 6, 2026 Companies 1
Human View Machine View

336th article in the last 90 days, one of 500 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA alerts to UEFI IOMMU initialization flaw on some motherboards (Dec 2025).

Companies mentioned

Best suited for

Seniority
Manager
Job function
Network / Network Engineer
Persona
Network Engineer
Buyer role
Technical Implementer / Administrator
Decision stage
Post Buy
Adoption curve
Late Majority
Industry
Information Technology / Technology Hardware & Equipment / Communications Equipment / Computer Networking

Our classification, not the publisher's statement. Best suited for, not only for.

TOTOLINK EX200 wireless extenders running the End-of-Life (EoL) firmware contain a flaw in the firmware-upload error-handling logic that can result in the device launching an unauthenticated root-level telnet service, which may allow a remote authenticated attacker to obtain full system access.

The issue affects the End-of-Life (EoL) TOTOLINK EX200 firmware and involves the firmware-upload handler entering an abnormal error state when processing certain malformed firmware files. When this error state occurs, the device launches a telnet service running with root privileges and that does not require authentication; the telnet interface is normally disabled and not intended to be exposed. Exploitation requires an attacker to be authenticated to the web management interface to reach the firmware-upload functionality, and once the error condition is triggered the unauthenticated telnet service provides full control of the device. The vulnerability is cataloged as CVE-2025-65606 and, as described, an authenticated attacker can trigger an error condition in the firmware-upload handler that causes the device to start an unauthenticated root telnet service, granting full system access.

A remote authenticated attacker may be able to activate a root telnet service and subsequently take complete control of the device. This may lead to configuration manipulation, arbitrary command execution, or establishing a persistent foothold on the network.

The vendor, TOTOLINK, has not released an update addressing this issue, and the product is no longer maintained.

The advisory recommends restricting administrative access to trusted networks, preventing untrusted users from accessing the management interface, monitoring for unexpected telnet activity, and planning to replace the vulnerable device.

Blog post, originally published by Timur Snoke at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-advisory-on-totolink-ex200-unauthenticated-root-telnet/",
        "name": "CISA issues advisory on TOTOLINK EX200 unauthenticated root telnet",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-advisory-on-totolink-ex200-unauthenticated-root-telnet/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Manager"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Network / Network Engineer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Network Engineer"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Late Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Technology Hardware & Equipment / Communications Equipment / Computer Networking"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:34:02-06:00",
    "datePublished": "2026-01-06T08:59:37-07:00",
    "description": "TOTOLINK EX200 vulnerability: a firmware-upload error can start an unauthenticated root telnet service, allowing full system access.",
    "headline": "CISA issues advisory on TOTOLINK EX200 unauthenticated root telnet",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Timur Snoke"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/295169"
    },
    "keywords": [
      "Firmware"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-advisory-on-totolink-ex200-unauthenticated-root-telnet/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages