CVE-2025-9577: Totolink x2000r Firmware

High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days.

A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component Administrative Interface. The manipulation results in use of default credentials. Attacking locally is a requirement. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be exploited.

Affected products

• Totolink x2000r Firmware: version 2.0.0-b20230727.1043.web only

Published 2025-08-28. Last modified 2026-07-25.