CVE-2025-29209: Totolink x18 Firmware

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.

Affected products

• Totolink x18 Firmware: version 9.1.0cu.2024_b20220329 only

Published 2025-04-18. Last modified 2026-06-17.