CVE-2025-9533 is a high severity (CVSS 7.3) improper authentication flaw in the TOTOLINK T10 router, firmware 4.1.8cu.5241_B20210927. The authCode argument handled by /formLoginAuth.htm can be manipulated to get past the login check, and a public exploit is reported. No fixed firmware is listed.
What's affected
The record lists the TOTOLINK T10 and its firmware, version 4.1.8cu.5241_B20210927. The description does not name the function, but the file is /formLoginAuth.htm and the argument is authCode. The attack is described as remote, and the exploit as public.
The one reference that points at a write up, a GitHub markdown file, returned a not found page when I fetched it, and the vendor site is listed without an advisory. I could not confirm a fixed firmware, so check the TOTOLINK support downloads for your exact hardware revision.
The class is CWE-287, improper authentication. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges, no user interaction, and low impact on confidentiality, integrity and availability.
How to check if you're exposed
Sign in to the router and read the firmware version on the system status page. A T10 on 4.1.8cu.5241_B20210927 is in scope. Then find out whether the web interface can be reached from outside your network. From a machine on a different network, and only against addresses you own:
nmap -p 80,8080,443 <router-wan-address>
If the management page answers, remote administration is on or the device sits on a public address. Also look at the router's own log for logins you do not recognise, and review DNS settings, port forwards and the list of admin accounts for changes you did not make.
What to do now
- Read the firmware version from the router status page.
- Turn off remote management so the login page is not reachable from the internet.
- Check the TOTOLINK downloads page for newer T10 firmware and install it if one exists, after confirming the file matches your hardware revision.
- Review DNS settings, port forwarding and admin users, and change the admin password.
- If the model no longer receives firmware, plan to replace it, and keep it off any network that reaches sensitive systems in the meantime.
Why it matters
Authentication is the one gate between the network and the device's settings. When a check can be satisfied by a manipulated value instead of a credential, the gate stops working. A router sits in front of everything else on the network, so control of it is control of where traffic goes.
The record rates each impact as low, which is a scoring convention and not a promise that the damage is small. The record says the CVE is not in the CISA Known Exploited Vulnerabilities catalog. It does say a public exploit exists.
Quick check
Is there a fixed firmware for CVE-2025-9533?
None is named in the record and I could not reach an advisory that names one. Check TOTOLINK support for your hardware revision.
Does this affect other TOTOLINK models?
The record lists only the T10 and the one firmware build. Other models may share code, but that is not stated, so check the vendor for each model you run.
Sources
- The write up cited by the record returned a not found page when fetched, so this post rests on the record fields
- Safeguard Gold entry: CVE-2025-9533
- CVE record fields as held in the Safeguard CVE record
Last reviewed: 18 October 2026.
