CVE-2025-2097 is a high severity stack based buffer overflow flaw (CVSS 8.8) in the TOTOLINK EX1800T Wi-Fi range extender, firmware 9.1.0cu.2112_B20220316. The setRptWizardCfg function in /cgi-bin/cstecgi.cgi mishandles the loginpass argument. No fixed firmware is named, so check TOTOLINK and limit access.
What's affected
- Product: TOTOLINK EX1800T and its firmware
- Affected firmware: 9.1.0cu.2112_B20220316
- Vulnerable function:
setRptWizardCfgin/cgi-bin/cstecgi.cgi, argumentloginpass - CVSS: 8.8 (High), vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Published: 2025-03-07
Neither the record nor the pages I could reach name a fixed firmware version. Check the TOTOLINK support site for a newer EX1800T release and read its notes before assuming anything is fixed.
The record says the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false for this CVE. The vector shows low privileges are required, which in practice means the attacker needs a login to the device's web interface first.
How to check if you're exposed
Router and extender firmware is not tracked by a package manager, so this is a manual check.
- Open the extender's web interface and find the firmware version on the status or system page.
- Compare it with
9.1.0cu.2112_B20220316. An exact match is affected. A different version is not covered by the record, so ask TOTOLINK. - Check whether the web interface answers on any address other than your local network. If you can reach it from outside, so can anyone else.
- Look at the device's admin accounts and change the default password if you have never done so.
If you keep an inventory of network devices, this is a good moment to record the model, firmware and who can reach the admin page. A free in-browser dependency scan will not see firmware, but it is useful for the software side of the same estate.
What to do now
- Identify every EX1800T on your networks and write down the firmware version of each.
- Check TOTOLINK's support pages for a newer firmware and apply it if one exists, after backing up the configuration.
- Turn off remote administration and make sure the admin page is reachable only from a trusted management network.
- Replace default or shared admin passwords with unique ones, because exploitation needs a login.
- Keep the extender off segments that hold sensitive systems until a fix is confirmed, or replace the unit if the vendor does not respond.
Why it matters
The record classes this under CWE-119, CWE-121 and CWE-787. In plain terms, a value supplied for loginpass is copied into a fixed size buffer on the stack without checking its length. Memory next to the buffer gets overwritten, which can crash the service or change what the device does.
The score of 8.8 is higher than the command injection siblings because the rated impact on confidentiality, integrity and availability is high rather than low. Embedded devices often lack the memory protections that make this harder on a desktop, and they rarely get fast firmware updates, so the practical defence is to limit who can reach the admin interface.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this exploited in the wild?
The CISA Known Exploited Vulnerabilities flag is false and no page I read reports active exploitation. The record says an exploit was disclosed publicly.
Do I need to log in to be affected?
The CVSS vector lists low privileges required, so a login to the web interface is expected. Weak or default passwords make that bar low.
Sources
Last reviewed: 19 October 2026.
