Volerion logoVolerion
Volerion logoVolerion

TOTOLINK X18 OS Command Injection Vulnerability in L2TP Configuration

Vulnerability

A critical OS command injection vulnerability has been identified in the TOTOLINK X18 router, specifically in version 9.1.0cu.2024_B20220329. The issue arises in the 'setL2tpdConfig' function within the '/cgi-bin/cstecgi.cgi' file, where improper handling of the 'enable' argument allows for command injection. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for OS command injection, where an attacker can execute arbitrary commands on the router's operating system.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
2.6
impact
7.5
exploitability
7.8
remediation
0.0
relevance
0.0
threat
0.0
urgency
2.9
incentive
9.2

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.