CVE-2025-29209 Command injection in n/a

Critical 9.8 Published 18 Apr 2025 Updated 22 Apr 2025

An attacker can execute arbitrary commands on TOTOLINK X18 routers via the enable parameter in cstecgi.cgi, leading to full system compromise.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-29209?

CVE-2025-29209 is a critical command injection vulnerability in n/a, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.

Weakness: CWE-77

Which versions are affected by CVE-2025-29209?

It affects 1 product.

Products include Totolink X18 Firmware.

How do I fix CVE-2025-29209?

No fix has been published for CVE-2025-29209 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-29209 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29209 exists.

Sources

Also known as GHSA-p688-g48x-vg8h.