CVE-2025-61045

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version V9.1.0cu.2053 B20230309

Description The setEasyMeshAgentCfg function in the TOTOLINK X18 router firmware does not properly sanitize data at the management level when processing the mac parameter. This can allow a remote attacker to execute arbitrary commands. The vulnerability is related to a command injection issue through the mac parameter within the setEasyMeshAgentCfg function.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the setEasyMeshAgentCfg function until a patch is available. Restrict access to the mac parameter in the affected function setEasyMeshAgentCfg() to minimize the risk of exploitation.