CVE-2025-61044: n/a
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 1.0% chance of exploitation in 30 days – higher than 63% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 1 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
1. Immediately restrict access to the router’s management interfaces by implementing network segmentation and firewall rules to limit exposure to trusted networks only. 2. Disable remote management features if not required, or enforce strong authentication and encrypted channels (e.g., HTTPS, VPN) for remote access. 3. Monitor network traffic and router logs for unusual commands or configuration changes indicative of exploitation attempts. 4. Apply firmware updates from TOTOLINK as soon as patches addressing CVE-2025-61044 become available. 5. For environments where patching is delayed, consider replacing affected devices with models from vendors with timely security support. 6. Educate users and administrators on the risks of command injection vulnerabilities and the importance of secure configuration. 7. Employ network intrusion detection systems (NIDS) tuned to detect command injection patterns targeting the agentName parameter or EasyMesh configuration endpoints. 8. Regularly audit router configurations and credentials to ensure they follow security best practices and are not default or weak.
Description
TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function.