Vulnerability in Totolink Range Extender Allows Device Takeover

SecurityWeek reports a security defect in the Totolink EX200 wireless range extender that could allow attackers to take over vulnerable devices. Tracked as CVE-2025-65606, the flaw lies in the firmware-upload error-handling logic, which when processing malformed firmware files can trigger an unauthenticated root-level Telnet service.

The Telnet service runs with root privileges and provides full system access, a condition described by CERT/CC as creating an unintended remote administration interface, according to CERT/CC’s advisory. Exploitation requires authenticated access to the device’s web management interface to trigger the error in the firmware-upload functionality, the article notes.

The vulnerable Totolink EX200 extender is no longer maintained, with the last firmware updates released in 2021 and 2023 for hardware revision 1 and 2 respectively, and there is no patch available for this defect, which was reported by Leandro Kogan. Users are advised to restrict administrative access, monitor for unexpected Telnet activity, and plan to replace the device, according to CERT/CC. 7 January 2026.