Executive Summary

CVE-2025-9533 is an improper authentication vulnerability in the TOTOLINK T10 router (version 4.1.8cu.5241_B20210927), specifically in the /formLoginAuth.htm file. By manipulating the 'authCode' argument with the input '1', an attacker can bypass authentication controls remotely without any prior authentication. This allows unauthorized access to the device. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing remote attackers to bypass authentication and gain unauthorized access to the affected router. This can compromise the confidentiality, integrity, and availability of the system, potentially leading to unauthorized control, data breaches, or disruption of network services. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the device is running TOTOLINK T10 version 4.1.8cu.5241_B20210927 and if the /formLoginAuth.htm endpoint is accessible. One method to identify vulnerable targets is using Google Dorking with the query "inurl:formLoginAuth.htm". On your network, you can attempt to send an HTTP request to the /formLoginAuth.htm page and test if manipulating the authCode parameter with the value "1" bypasses authentication. For example, using curl: curl -X POST "http://<target-ip>/formLoginAuth.htm" -d "authCode=1" and observe if authentication is bypassed. This indicates the presence of the vulnerability. [1]

Useful 0 Not Useful 0

Mitigation Strategies

There are no known countermeasures or mitigations currently available for this vulnerability. The suggested immediate step is to replace the affected TOTOLINK T10 device with an alternative product to avoid exploitation. [1]

Useful 0 Not Useful 0