CVE-2025-61045 is a critical (CVSS 9.8) command injection in the TOTOLINK X18 router, firmware V9.1.0cu.2053_B20230309. The setEasyMeshAgentCfg function passes the mac parameter to a system command without safe handling. The record names no fixed firmware, so check the vendor and limit access.
What's affected
- Product: TOTOLINK X18 router and its firmware.
- Affected: firmware V9.1.0cu.2053_B20230309, per the record. Other builds may also be affected; the record does not say.
- Vulnerable function:
setEasyMeshAgentCfg, parametermac. - Weaknesses: CWE-77 (command injection) and CWE-78 (OS command injection).
- Fixed: none named in the record.
- CVSS 3.1: 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No login and no user interaction. - Known exploited: no, the record is not on the CISA KEV list.
- Related: CVE-2025-61044 is a sibling entry for the same function through a different parameter.
The record is short. It does not describe a vendor advisory, so the details of affected builds should be confirmed with TOTOLINK.
How to check if you're exposed
Find the device and its firmware version. In the router admin interface, the status or system page shows the firmware string. Compare it to V9.1.0cu.2053_B20230309.
Then check where the management interface is reachable:
# run from outside the trusted LAN to see whether the web admin port answers
nc -zv <router-address> 80 443
Replace the placeholder with the router's address. If the device answers from the internet, that is the critical exposure. Also check whether the EasyMesh feature is enabled, since the vulnerable function is part of that configuration. If you do not use EasyMesh, turn it off where the interface allows, but do not treat that as a fix.
What to do now
- Inventory TOTOLINK X18 units and note their firmware versions.
- Check the TOTOLINK download pages for a firmware newer than V9.1.0cu.2053_B20230309, and read its release notes. The record names no fix.
- Turn off remote management from the wide area network, and limit the admin interface to a trusted LAN segment.
- Change the administrator password, and review the device for unknown settings, users or DNS changes.
- Disable EasyMesh features you do not use.
- If no fix appears and the device sits at the network edge, plan a replacement.
Why it matters
Command injection (CWE-77) occurs when text from a request is placed into a command that the system runs. Anyone who controls that text can add their own commands, and on a router those commands run with high privileges. That is why the vector shows high impact on confidentiality, integrity and availability with no login needed.
Router firmware is a repeat offender here because the web management layer is written in C or shell glue, and values from forms are passed along to utilities. The same function often has several injectable parameters, which is why this function has two CVEs so far and may have more.
Consumer and small business routers also rarely get patches quickly. The practical defence is placement: no internet-facing management, a strong admin password, and a plan to replace unsupported devices. The record does not mark this as exploited in the wild.
Quick check
Is CVE-2025-61045 the only parameter affected?
No. The record for CVE-2025-61044 covers a different parameter of the same function. Treat the function as vulnerable.
Is a fix available?
The record names none. Check the vendor downloads and limit access in the meantime.
Sources
Last reviewed: 18 October 2026.
