CVE-2025-1829

Summary

CVE-2025-1829 is a critical vulnerability affecting the TOTOLINK X18's 9.1.0cu.2024_B20220329 firmware. The issue lies within the function setMtknatCfg of the /cgi-bin/cstecgi.cgi file, where manipulation of the argument mtkhnatEnable can lead to os command injection. This vulnerability allows remote attackers to execute arbitrary commands. Alarmingly, the exploit for this vulnerability has been disclosed to the public, increasing the risk of potential exploitation. Despite early disclosure to the vendor, they have not responded or issued a patch.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.