CERT/CC warns of critical, unfixed vulnerability in TOTOLINK EX200

According to CERT/CC’s advisory, a vulnerability in the TOTOLINK EX200 range extender has been disclosed but remains unpatched, tracked as CVE-2025-65606. The flaw exists in the end-of-life TOTOLINK EX200 firmware and allows a remote authenticated attacker to fully compromise the device by triggering an abnormal state during firmware uploads. When exploited, the upload handler can cause the device to launch a telnet service running as root and without authentication, effectively granting full remote control.

The researchers note that exploitation requires prior access to the web management interface, but once triggered the telnet interface provides complete system takeover, with the telnet service normally disabled and not intended to be exposed. The vulnerability was reported by researcher Leandro Kogan, and TOTOLINK has not patched the flaw or continued device support, prompting guidance to limit admin access, monitor for telnet activity, and replace the extender. The disclosure emphasises the risk posed by unauthorised remote administration through a normally disabled interface.