CVE-2025-1829

🗓️ 02 Mar 2025 19:00:07Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 87 Views🌐 WEB

Critical vulnerability in TOTOLINK X18 leads to remote OS command injection risk.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-1829	2 Mar 202519:28	–	circl
CNNVD	TOTOLINK X18 安全漏洞	2 Mar 202500:00	–	cnnvd
CNVD	TOTOLINK X18 Command Injection Vulnerability	7 Mar 202500:00	–	cnvd
Cvelist	CVE-2025-1829 TOTOLINK X18 cstecgi.cgi setMtknatCfg os command injection	2 Mar 202519:00	–	cvelist
EUVD	EUVD-2025-5854	3 Oct 202520:07	–	euvd
NVD	CVE-2025-1829	2 Mar 202519:15	–	nvd
Positive Technologies	PT-2025-9194	21 Feb 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-1829	7 Jan 202609:18	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2025-1829	9 Oct 202500:00	–	vulncheck_kev
Vulnrichment	CVE-2025-1829 TOTOLINK X18 cstecgi.cgi setMtknatCfg os command injection	2 Mar 202519:00	–	vulnrichment

NVD

Node

totolink x18_firmwareMatch9.1.0cu.2024_b20220329

AND

totolink x18Match-

[
  {
    "vendor": "TOTOLINK",
    "product": "X18",
    "versions": [
      {
        "version": "9.1.0cu.2024_B20220329",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
totolink	www.totolink.net/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/sjwszt/CVE/blob/main/CVE_2.md

Parameter	Position	Path	Description	CWE
mtkhnatEnable	request body	/cgi-bin/cstecgi.cgi	OS command injection via mtkhnatEnable parameter in setMtknatCfg of /cgi-bin/cstecgi.cgi (Totolink X18 9.1.0cu.2024_B20220329).	CWE-78, CWE-77

03 Apr 2025 15:35Current

7.3High risk

Vulners AI Score7.3

CVSS 3.16.3 - 8.8

CVSS 45.3

CVSS 26.5

CVSS 36.3

EPSS0.00824

SSVC

cve 2025 1829 totolink x18 critical vulnerability command injection remote attack