Unpatched Firmware Flaw Exposes TOTOLINK EX200 to Full Remote Device Takeover

The CERT Coordination Center (CERT/CC) has disclosed details of an unpatched security flaw impacting TOTOLINK EX200 wireless range extender that could allow a remote authenticated attacker to gain full control of the device.

The flaw, CVE-2025-65606 (CVSS score: N/A), has been characterized as a flaw in the firmware-upload error-handling logic, which could cause the device to inadvertently start an unauthenticated root-level telnet service. CERT/CC credited Leandro Kogan for discovering and reporting the issue.

“An authenticated attacker can trigger an error condition in the firmware-upload handler that causes the device to start an unauthenticated root telnet service, granting full system access,” CERT/CC said.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Successful exploitation of the flaw requires an attacker to be already authenticated to the web management interface to access the firmware-upload functionality.

CERT/CC said the firmware-upload handler enters an “abnormal error state” when certain malformed firmware files are processed, causing the device to launch a telnet service with root privileges and without requiring any authentication.

This unintended remote administration interface could be exploited by the attacker to hijack susceptible devices, leading to configuration manipulation, arbitrary command execution, or persistence.

According to CERT/CC, TOTOLINK has not released any patches to address the flaw, and the product is said to be no longer actively maintained. TOTOLINK’s web page for EX200 shows that the firmware for the product was last updated in February 2023.

In the absence of a fix, users of the appliance are advised to restrict administrative access to trusted networks, prevent unauthorized users from accessing the management interface, monitor for anomalous activity, and upgrade to a supported model.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.