Unpatched Firmware Flaw Exposes TOTOLINK EX200 to Full Remote Device Takeover

The CERT Coordination Center (CERT/CC) has disclosed details of an unpatched security flaw affecting the TOTOLINK EX200 wireless range extender, which could allow a remote authenticated attacker to gain full control of the device. The flaw, CVE-2025-65606 (CVSS score: N/A), stems from the firmware-upload error-handling logic and could cause the device to start an unauthenticated root-level telnet service.

An authenticated attacker can trigger this error condition via the firmware-upload handler, granting full system access, CERT/CC said. Successful exploitation requires the attacker to already be authenticated to the web management interface to access the firmware-upload functionality, and CERT/CC noted the firmware-upload handler enters an abnormal error state that launches a root telnet service without authentication.

CERT/CC also stated that TOTOLINK has not released any patches, and the product is no longer actively maintained; TOTOLINK’s EX200 firmware last update was in February 2023. In light of no fix being available, users are advised to restrict administrative access to trusted networks, monitor for anomalies, and upgrade to a supported model.