CVE-2025-1852 is a high severity buffer overflow flaw in Totolink EX1800T firmware 9.1.0cu.2112_B20220316, scored 8.8. Oversized input can overrun a memory buffer. No fixed version is named, so check the vendor and limit exposure. The record says exploit details are public, and it is not on the CISA KEV list.
What's affected
The CVE record lists Totolink EX1800T firmware 9.1.0cu.2112_B20220316. The weakness sits in the loginAuth function in /cgi-bin/cstecgi.cgi, through the password input.
- Product: Totolink EX1800T
- Affected: firmware 9.1.0cu.2112_B20220316
- Fixed: not named in the CVE record
- Severity: High, CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Known exploited (CISA KEV): no, the record's kev flag is false
The CVE record does not name a fixed version. The vendor advisory, if one exists, should be checked before you rely on any version number.
The record also says the exploit has been disclosed to the public and may be used. That is a statement about public technical details, not a statement that attacks are underway. KEV status is false, and nothing in the record claims in the wild exploitation.
How to check if you're exposed
This is device firmware, so there is no package to query.
- Open the router admin page and read the firmware version. Compare it with firmware 9.1.0cu.2112_B20220316 from the record.
- Check whether the web management interface is reachable from the internet or from guest networks. Remote management, port forwards and UPnP mappings are the usual causes.
- Review the vendor support page for a newer firmware image for your exact hardware revision. The CVE record does not name a fixed version.
- Note the model and version in your asset list so you can find it again when a fix appears.
Because password is the input involved, anything that exposes the login or configuration handlers to untrusted networks raises the risk.
What to do now
- Inventory every Totolink EX1800T and record the firmware version.
- Turn off remote administration and any port forward that reaches the admin interface.
- Keep the device off networks where untrusted users can reach its web interface, including guest wifi.
- Check the vendor support page for newer firmware for your hardware revision. The CVE record names no fixed version.
- Use a strong unique admin password, because the issue needs a low privileged account (PR:L in the vector).
- Plan replacement if the vendor stays silent. A device with a public memory corruption bug and no updates should not guard a network edge.
Why it matters
The weakness is a memory buffer overflow. The firmware copies the password value into a fixed size buffer without checking its length. Data written past the end of the buffer can overwrite neighbouring memory and change what the program does.
The record scores confidentiality, integrity and availability impact as high, and says the attack needs a low privileged account (PR:L in the vector). On routers the web server process often runs with full rights, so even a crash can take the device offline. Memory corruption on consumer firmware is hard to detect from the outside, so reduce exposure first.
The record maps this to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Classic Buffer Overflow).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-1852 exploited in the wild?
The record's CISA KEV flag is false, and nothing in the record says attacks are underway. It does say the exploit has been disclosed to the public, so assume the technical details are available.
Is there a patch for Totolink EX1800T?
The CVE record names no fixed version. Check the vendor support page and advisory, and reduce exposure of the management interface in the meantime.
Sources
- Safeguard Gold entry for CVE-2025-1852
- CVE record data as supplied for this review (NVD description, CVSS vector, CWE list). The references below are listed in the record and were not all fetched for this page, so confirm details against the vendor before acting.
- https://github.com/watermelon-happy/cve/blob/main/ex1800tCVE.md
- https://vuldb.com/?ctiid.298120
- https://vuldb.com/?id.298120
- https://vuldb.com/?submit.505362
- https://www.totolink.net/
Last reviewed: 19 October 2026.
