cbcvebase.
CVE-2025-61044
published 2025-10-01

CVE-2025-61044: TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg…

PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.02%
59.5th percentile
TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function.

Affected

1 ranges
VendorProductVersion rangeFixed in
totolinkx18_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/cstecgi.cgi
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink setEasyMeshAgentCfg agentName Parameter Command Injection Attempt (CVE-2025-52906, CVE-2025-61044, CVE-2025-61045)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/cgi-bin/cstecgi.cgi"; http.request_body; content:"topicurl|3d|setEasyMeshAgentCfg"; fast_pattern; pcre:"/(?:mac|agent)\x3d[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/"; reference:url,github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0002/PANW-2025-0002.md; reference:cve,2025-52906; reference:url,github.com/ilovekeer/IOT/blob/main/TOTOLINK/X18/setEasyMeshAgentCfg/1.md; reference:cve,2025-61045; reference:cve,2025-61044; reference:url,github.com/ilovekeer/IOT/blob/main/TOTOLINK/X18/setEasyMeshAgentCfg/2.md; classtype:attempted-admin; sid:2064884; rev:2;)
  • →Exploit targets HTTP POST requests to /cgi-bin/cstecgi.cgi with body containing 'topicurl=setEasyMeshAgentCfg'; match on the fast_pattern content 'topicurl|3d|setEasyMeshAgentCfg' in the request body.
  • →Command injection payload is injected into the 'mac' or 'agent' parameter (corresponding to agentName) using shell metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24).
  • →URI path is exactly 20 bytes long (/cgi-bin/cstecgi.cgi); use a URI length constraint of bsize:20 to reduce false positives.
  • →Traffic is plaintext (non-TLS); deploy detection at the network perimeter and internally on flat/IoT segments.
  • →MITRE mapping: TA0001 Initial Access / T1190 Exploit Public-Facing Application — prioritise detections on internet-exposed TOTOLINK X18 devices.
  • ·The Snort/Suricata rule (sid:2064884) covers three CVEs simultaneously (CVE-2025-52906, CVE-2025-61044, CVE-2025-61045); a true-positive alert does not distinguish which specific CVE is being exploited without deeper payload inspection.
  • ·Affected firmware is specifically TOTOLINK X18 V9.1.0cu.2053_B20230309; detections should be scoped to that device/firmware version to avoid noise from unrelated TOTOLINK models. ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.