CVE-2025-61044: Totolink x18 Firmware

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function.

Affected products

• Totolink x18 Firmware: version 9.1.0cu.2053_b20230309 only

Published 2025-10-01. Last modified 2026-06-17.