CVE-2025-9577
BaseFortify
Publication date: 2025-08-28
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | x2000r_firmware | 2.0.0-b20230727.1043.web |
| totolink | x2000r | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1392 | The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9577 is a security flaw in the TOTOLINK X2000R router (firmware up to version 2.0.0) where the root user account uses a weak default password ('123456') stored in a world-readable file (/etc/shadow.sample). The password is hashed with MD5-crypt, which can be cracked easily using tools like John the Ripper. This allows an attacker with local access to gain unauthorized root access to the device through the administrative interface or network services. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized root access to the affected TOTOLINK router, compromising the device's confidentiality and security. An attacker with local access can exploit the weak default credentials to control the device, potentially leading to further network compromise or misuse of the router's administrative functions. However, exploitation is difficult and requires local access. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the presence and permissions of the file /etc/shadow.sample on the TOTOLINK X2000R device and verifying if it contains the default root password hash. Since the password is hashed using MD5-crypt and is weak (e.g., '123456'), tools like John the Ripper can be used to crack the password hash. Commands to detect this could include: 1) Access the device locally and run 'ls -l /etc/shadow.sample' to check file existence and permissions. 2) Extract the hash from /etc/shadow.sample and use John the Ripper to attempt cracking it, e.g., 'john --format=md5crypt shadow.sample'. Detection requires local access to the device. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting local access to the device to prevent exploitation, as the attack requires local access and is difficult to perform. Since no known countermeasures or patches are available, it is recommended to replace the affected product or component to avoid risk. Additionally, changing default credentials if possible and ensuring sensitive files like /etc/shadow.sample are not world-readable can help reduce exposure. [2]