CVE-2025-9577 | BDVDB-2026-291357 Detail

TOTOLINKX2000R

Description#

A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component Administrative Interface. The manipulation results in use of default credentials. Attacking locally is a requirement. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be exploited.

Impact#

Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: local.

Weaknesses#

CWE-1392 Use of Default Credentials

References#

Exploit#

https://github.com/XXRicardo/iot-cve/blob/main/TOLOLINK/X2000R-Gh-V2.0.0.md#steps-to-reproduce

History#

Version 12025-08-28Record published in the CVE List.

Published

Published: 2025-08-28
Last modified: 2025-08-28

Vendor information

Vendor: TOTOLINK
Product: X2000R

All TOTOLINK vulnerabilities

Score

2.5 Low

EPSS

less than 1%, Very Low

Estimated chance of exploitation in the next 30 days. EPSS percentile: 13.0.

KEV

Not listed in the CISA Known Exploited Vulnerabilities catalog.

Impact

Not classified

Action

No specific action is recorded in the source data. Check the references for vendor guidance.

Affected Systems

Vulnerable
2.0
Fixed
Not stated

Scoring System

CVSS v4.0

2.0 Low

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Metric breakdown
Attack Vector	Local
Attack Complexity	High
Attack Requirements	None
Privileges Required	Low
User Interaction	None
Vulnerable System Confidentiality	Low
Vulnerable System Integrity	None
Vulnerable System Availability	None
Subsequent System Confidentiality	None
Subsequent System Integrity	None
Subsequent System Availability	None

CVSS v3.1

2.5 Low

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Metric breakdown
Attack Vector	Local
Attack Complexity	High
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity	None
Availability	None

CVSS v3.0

2.5 Low

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Metric breakdown
Attack Vector	Local
Attack Complexity	High
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity	None
Availability	None

CVSS v2

1.0 Low

AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR

Metric breakdown
Access Vector	Local
Access Complexity	High
Authentication	Single
Confidentiality Impact	Partial
Integrity Impact	None
Availability Impact	None

Source: CVE List v5 (record); CISA KEV (kev, action); FIRST EPSS (epss).