CVE-2025-2096 is a medium severity OS command injection flaw (CVSS 6.3) in the TOTOLINK EX1800T Wi-Fi range extender, firmware 9.1.0cu.2112_B20220316. The setRebootScheCfg function in /cgi-bin/cstecgi.cgi mishandles the mode/week/minute/recHour argument. No fixed firmware is named, so check TOTOLINK and limit access.
What's affected
- Product: TOTOLINK EX1800T and its firmware
- Affected firmware: 9.1.0cu.2112_B20220316
- Vulnerable function:
setRebootScheCfgin/cgi-bin/cstecgi.cgi, argumentmode/week/minute/recHour - CVSS: 6.3 (Medium), vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Published: 2025-03-07
Neither the record nor the pages I could reach name a fixed firmware version. Check the TOTOLINK support site for a newer EX1800T release and read its notes before assuming anything is fixed.
The record says the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false for this CVE. The vector shows low privileges are required, which in practice means the attacker needs a login to the device's web interface first.
How to check if you're exposed
Router and extender firmware is not tracked by a package manager, so this is a manual check.
- Open the extender's web interface and find the firmware version on the status or system page.
- Compare it with
9.1.0cu.2112_B20220316. An exact match is affected. A different version is not covered by the record, so ask TOTOLINK. - Check whether the web interface answers on any address other than your local network. If you can reach it from outside, so can anyone else.
- Look at the device's admin accounts and change the default password if you have never done so.
If you keep an inventory of network devices, this is a good moment to record the model, firmware and who can reach the admin page. A free in-browser dependency scan will not see firmware, but it is useful for the software side of the same estate.
What to do now
- Identify every EX1800T on your networks and write down the firmware version of each.
- Check TOTOLINK's support pages for a newer firmware and apply it if one exists, after backing up the configuration.
- Turn off remote administration and make sure the admin page is reachable only from a trusted management network.
- Replace default or shared admin passwords with unique ones, because exploitation needs a login.
- Keep the extender off segments that hold sensitive systems until a fix is confirmed, or replace the unit if the vendor does not respond.
Why it matters
The record classes this under CWE-78, OS command injection, with its parent CWE-77. Text typed into a setting is passed to a shell command on the device without being cleaned. The device then treats part of that text as a command.
The CVSS score is 6.3 because exploitation needs a login and the rated impacts are low on each axis. That understates the real risk on a device like this, where a command runs with the rights of the web service on a box that sits between your users and the network. TOTOLINK has several sibling CVEs for this same file, so a fix for one function does not mean the whole interface is clean.
Quick check
Is this exploited in the wild?
The CISA Known Exploited Vulnerabilities flag is false and no page I read reports active exploitation. The record says an exploit was disclosed publicly.
Is a firmware update available?
The record does not name one. Check the TOTOLINK support site for the EX1800T and read the release notes for this CVE before relying on it.
Sources
Last reviewed: 19 October 2026.
