CVE-2025-65606: TOTOLINK EX200 Error Opens Root Telnet Door

CVE-2025-65606 is a vulnerability in the TOTOLINK EX200 Wi‑Fi extender that turns an error during a firmware upload into an unauthenticated root Telnet service. The flaw occurs when the device, already End-of-Life, enters an abnormal error state during certain malformed firmware files, launching a Telnet service with root privileges and no authentication required.

An attacker must first have access to the web management interface to trigger the bug, and only then can uploading a malformed file elevate a standard administrator to full system owner. The report notes that the EX200 is no longer maintained and no patch is expected, according to CERT/CC.

CERT/CC advises users to stop using the device if possible, or otherwise implement strict network segmentation, restrict administrative access to trusted networks, prevent untrusted users from accessing the management interface, monitor for unexpected Telnet activity, and plan to replace the vulnerable device. The vulnerability affects devices that are already out of support, raising concerns for users still reliant on older units.