CVE-2025-65606 Allows Remote Takeover of TOTOLINK EX200

Unpatched Firmware Flaw Exposes TOTOLINK EX200 to Full Remote Device Takeover: CVE-2025-65606 and CVE-2026-0625

Estimated Reading Time: 6 minutes

Unpatched Firmware Flaw Exposes TOTOLINK EX200 to Full Remote Device Takeover

The discovery of an unpatched firmware flaw exposes TOTOLINK EX200 to full remote device takeover, raising immediate concerns for network administrators and security engineers managing distributed hardware environments. This vulnerability, identified as CVE-2025-65606, resides in the device’s firmware-upload error-handling logic. If triggered, the flaw allows an authenticated attacker to bypass standard security protocols and gain root-level access via an unintended telnet service. This incident occurs alongside the active exploitation of CVE-2026-0625, a critical command injection vulnerability affecting legacy D-Link routers. Both cases emphasize the persistence of vulnerabilities in end-of-life (EoL) hardware and the necessity of a comprehensive cyber threat intelligence platform to track emerging exploits in unmaintained firmware.

The vulnerability in the TOTOLINK EX200 wireless range extender, documented by the CERT Coordination Center (CERT/CC), stems from a failure in how the device processes malformed firmware files. According to the research findings, an authenticated attacker can intentionally trigger an “abnormal error state” during a firmware upload. Instead of safely terminating the process or reverting to a secure state, the EX200 responds by launching a telnet service with root privileges. Critically, this telnet service does not require authentication, providing an open door for full system manipulation.

While the initial entry point requires authentication to the web management interface, the subsequent privilege escalation to root-level telnet access bypasses all remaining security controls. Once the telnet service is active, an attacker can execute arbitrary commands, modify device configurations, and establish persistence within the network. Because TOTOLINK has ceased active maintenance for the EX200-with the last firmware update released in February 2023-no official patch is expected. This leaves the hardware permanently susceptible to exploitation unless decommissioned or isolated.

Technical Analysis of CVE-2025-65606

The core of the issue lies in the firmware-upload handler’s logic. In standard operations, a firmware update should undergo integrity checks and signature verification before being applied. In the case of the TOTOLINK EX200, providing a malformed file disrupts the execution flow. The research suggests that the error-handling routine inadvertently triggers a debug or recovery mode that enables the telnet daemon (telnetd) under the root user account.

For threat actors, this represents a low-complexity path to total device compromise. In an enterprise context, these range extenders are often used to provide connectivity in hard-to-reach areas of a facility. If an attacker gains access to the local network or compromises a user’s credentials, they can move laterally to the EX200, trigger CVE-2025-65606, and use the device as a persistent foothold for traffic sniffing or further internal scanning.

“The lack of a CVSS score at the time of disclosure does not diminish the risk. The capability to gain unauthenticated root access on a networking device is functionally a critical-level event.”

Organizations relying on manual breach detection may miss the activation of the telnet service, as many legacy IoT devices do not provide granular logging or telemetry to a centralized SIEM.

Concurrent Exploitation: D-Link CVE-2026-0625

While the TOTOLINK flaw remains a looming threat for unpatched devices, the industry is also contending with the active exploitation of CVE-2026-0625. This vulnerability affects several D-Link legacy DSL routers, including models DSL-526B, DSL-2640B, DSL-2740R, and DSL-2780B. The flaw is located in the dnscfg.cgi endpoint and is caused by improper input sanitization within a CGI library.

Unlike the TOTOLINK flaw, CVE-2026-0625 allows for unauthenticated remote code execution (RCE). An attacker can inject arbitrary shell commands through DNS configuration parameters. The Shadowserver Foundation has already observed command injection attempts on honeypots, confirming that threat actors are actively scanning for and exploiting this vulnerability.

The difficulty in remediating CVE-2026-0625 mirrors the TOTOLINK situation: the affected devices are end-of-life. D-Link has confirmed that no security patches or maintenance will be provided. The convergence of these two vulnerabilities highlights a broader trend where legacy networking hardware becomes a primary target for botnet operators and initial access brokers.

The Role of Threat Intelligence in IoT Security

Monitoring these vulnerabilities requires more than just scanning for known CVEs. Threat actors frequently discuss exploits for EoL hardware on encrypted messaging platforms and hidden web forums. Utilizing a PurpleOps Solutions allows organizations to identify when specific device exploits, such as those for TOTOLINK or D-Link, are being weaponized or sold as part of an exploit kit.

Furthermore, telegram threat monitoring has become essential for tracking real-time exploitation trends. Many modern botnet operators use Telegram to coordinate attacks and share successful payloads for command injection vulnerabilities. By integrating underground forum intelligence, security teams can gain early warning signs of targeted campaigns against specific hardware versions used within their supply chain.

For enterprises, supply-chain risk monitoring must extend to the “last mile” of hardware. If a third-party vendor or a remote office utilizes the TOTOLINK EX200 or legacy D-Link routers, they introduce a vulnerability that can be leveraged for PurpleOps Solutions if sensitive data is subsequently exfiltrated through these compromised gateways.

Technical Takeaways for Engineers

• Service Identification and Disablement: If TOTOLINK EX200 devices are present, engineers must verify if the telnet service is active. Use a network scanner to check for open ports 23 (Telnet). Since the device is EoL and unpatched, the only secure path is to disable the device and replace it with modern hardware.
• Access Control Lists (ACLs): For devices that cannot be immediately replaced, restrict access to the web management interface. Ensure that only specific, authorized administrative IPs can access the firmware upload page.
• Network Segmentation: Isolate IoT and networking infrastructure like range extenders into a dedicated VLAN. This prevents an attacker who takes over the EX200 from easily accessing the primary corporate network.
• Log Monitoring: Monitor for unusual reboots or configuration changes in legacy routers. For the D-Link vulnerability, look for suspicious strings in HTTP requests directed at dnscfg.cgi, particularly those containing shell metacharacters (e.g., ;, |, `).

Operational Takeaways for Business Leaders

• Hardware Lifecycle Management: Audit the network to identify all EoL hardware. Devices like the TOTOLINK EX200 represent an unacceptable risk profile. Establish a policy for mandatory decommissioning of networking gear once it reaches EoL status.
• Supply Chain Visibility: Require vendors and partners to disclose the networking hardware used in environments that handle your company’s data. PurpleOps Solutions is a critical component of modern compliance.
• Investment in Intelligence: Move beyond reactive scanning. Implementing a live ransomware API and real-time ransomware intelligence can help identify if your hardware assets are being targeted by known ransomware groups.
• Incident Response Planning: Ensure that the incident response team has a specific playbook for IoT compromise. Because these devices lack standard EDR agents, response relies on network-level PurpleOps Solutions and traffic analysis.

PurpleOps Expertise and Services

Addressing vulnerabilities in unpatched firmware and legacy IoT devices requires a multi-layered approach to security. PurpleOps provides the specialized services necessary to detect, monitor, and mitigate these risks before they result in a full-scale breach.

Our Cyber Threat Intelligence platform is designed to provide visibility into the specific threats targeting your infrastructure. By leveraging a PurpleOps Solutions, PurpleOps can identify if credentials for your administrative interfaces or technical details about your network architecture are being circulated in the underground.

For organizations concerned about the security of their internal and external hardware, our PurpleOps Solutions services simulate the tactics used by real-world attackers. We specifically test for flaws like CVE-2025-65606 and CVE-2026-0625 to determine if your current network segmentation and access controls are sufficient to prevent a device takeover.

Furthermore, our PurpleOps Solutions assessments help you manage the risks associated with third-party hardware and vendors. We ensure that the devices connecting to your network meet modern security standards.

Leveraging Real-Time Intelligence

The exploitation of TOTOLINK and D-Link devices is often a precursor to more significant attacks. Many ransomware groups utilize compromised routers as proxies to hide their true location or as entry points for deploying lateral movement tools. By utilizing real-time ransomware intelligence, PurpleOps helps organizations stay ahead of these actors.

Our platform integrates underground forum intelligence and telegram threat monitoring to track the development of exploit scripts. This allows our clients to receive PurpleOps Solutions and PurpleOps Solutions notifications long before a vulnerability is exploited in their specific environment.

Conclusion and Path Forward

The disclosure of CVE-2025-65606 and CVE-2026-0625 serves as a factual reminder that networking hardware remains a vulnerable link in the security chain. The ability to achieve root access through firmware-upload errors or command injection in CGI endpoints provides attackers with a powerful toolset for bypassing traditional defenses.

For engineers, the priority is clear: identify, segment, and replace. For business leaders, the focus must be on lifecycle management and proactive intelligence. Relying on hardware that is no longer maintained creates a permanent window of opportunity for threat actors.

To learn more about how PurpleOps can secure your network and provide advanced threat intelligence, explore our Platform and PurpleOps Solutions. Our team of experts is ready to assist in auditing your infrastructure and implementing the monitoring solutions necessary to protect against unpatched and legacy threats. For a detailed assessment of your current risk profile or to discuss a specific security challenge, PurpleOps Solutions.