cbcvebase.
CVE-2025-61045
published 2025-10-01

CVE-2025-61045: TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function.

PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.54%
72.1th percentile
TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function.

Affected

1 ranges
VendorProductVersion rangeFixed in
totolinkx18_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/cstecgi.cgi
urlhttps://github.com/ilovekeer/IOT/blob/main/TOTOLINK/X18/setEasyMeshAgentCfg/1.md
urlhttps://github.com/ilovekeer/IOT/blob/main/TOTOLINK/X18/setEasyMeshAgentCfg/2.md
urlhttps://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0002/PANW-2025-0002.md
  • →Exploit targets HTTP POST requests to /cgi-bin/cstecgi.cgi with body containing 'topicurl=setEasyMeshAgentCfg' and command injection characters (;, newline, backtick, pipe, $) in the 'mac' or 'agent' parameters.
  • →Command injection is via the 'mac' parameter in the setEasyMeshAgentCfg function; both URL-encoded and literal shell metacharacters should be inspected (;, %3B, newline %0A, backtick %60, pipe %7C, dollar-sign %24).
  • →Affected device and firmware: TOTOLINK X18 V9.1.0cu.2053_B20230309; detections should be scoped to this networking equipment. ↗
  • →ET rule SID 2064884 (rev:2) covers this CVE alongside CVE-2025-52906 and CVE-2025-61044; deploy at perimeter and internal chokepoints for plaintext HTTP traffic.
  • ·The Snort/Suricata rule URI match uses 'bsize:20', meaning it only fires when the URI is exactly 20 bytes (/cgi-bin/cstecgi.cgi); ensure your sensor does not strip or normalize the URI before matching.
  • ·The rule is scoped to plaintext HTTP (tls_state plaintext); traffic tunneled over TLS will not be detected without SSL inspection.
  • ·The PCRE covers both the 'mac' and 'agent' parameter names, as this rule is shared across CVE-2025-52906, CVE-2025-61044, and CVE-2025-61045; tune alerting context accordingly to avoid cross-CVE confusion.
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.