CVE-2025-13184

Critical

Published: 10/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leads to unauthenticated root login with a blank password on X5000R V9.1.0u.6369_B20230113, allowing arbitrary command execution. Earlier versions sharing the same implementation may also be affected.

Risk Assessment

An unauthenticated attacker can gain full root access to the device, allowing full control and arbitrary command execution.

Recommendation

Update the device firmware to the latest version that fixes the vulnerability, or restrict access to cstecgi.cgi.

Original NVD description (English source)

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.