CVE-2025-9577
Low
No strong exploitation signal.
CVSS base
2.5
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS — probability of exploitation (30 days)
0.2%
10.4th percentile
CISA KEV
Not listed
Weakness / dates
CWE-1392
Published 2025-08-28 · modified 2026-07-25
CVSS breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
| Attack Vector | L | Local |
| Attack Complexity | H | High |
| Privileges Required | L | Low |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | L | Low |
| Integrity | N | None |
| Availability | N | None |
Timeline
- 2025-08-28 — Published (NVD)
- 2026-07-25 — Last modified (NVD)
Description
A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component Administrative Interface. The manipulation results in use of default credentials. Attacking locally is a requirement. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be exploited.
Affected
References
- exploit https://github.com/XXRicardo/iot-cve/blob/main/TOLOLINK/X2000R-Gh-V2.0.0.md
- exploit https://github.com/XXRicardo/iot-cve/blob/main/TOLOLINK/X2000R-Gh-V2.0.0.md#steps-to-reproduce
- https://vuldb.com/?ctiid.321691
- https://vuldb.com/?id.321691
- https://vuldb.com/?submit.636069
- https://www.totolink.net/
- exploit https://github.com/XXRicardo/iot-cve/blob/main/TOLOLINK/X2000R-Gh-V2.0.0.md
- exploit https://github.com/XXRicardo/iot-cve/blob/main/TOLOLINK/X2000R-Gh-V2.0.0.md#steps-to-reproduce