Login Request a demo
XF
Product
X18 Firmware
by Totolink · last CVE Oct 1, 2025
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 10High 4Medium 0Low 0
Severity
All severities14Critical10High4Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add X18 Firmware to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-61045
9.8
2%
Oct 1
TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function
Affected: 9.1.0cu.2053_b20230309
CVE-2025-61044
9.8
1%
Oct 1
TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function
Affected: 9.1.0cu.2053_b20230309
CVE-2025-29209
9.8
1%
Apr 18
TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi
Affected: 9.1.0cu.2024_b20220329
CVE-2025-29064
9.8
1%
Apr 3
An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi
Affected: 9.1.0cu.2024_b20220329
CVE-2023-29803
9.8
2%
Apr 14
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function
Affected: 9.1.0cu.2024_b20220329
CVE-2023-29802
9.8
2%
Apr 14
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function
Affected: 9.1.0cu.2021_b20220326; 9.1.0cu.2024_b20220329
CVE-2023-29801
9.8
2%
Apr 14
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg…
Affected: 9.1.0cu.2024_b20220329
CVE-2023-29800
9.8
2%
Apr 14
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function
Affected: 9.1.0cu.2024_b20220329
CVE-2023-29799
9.8
2%
Apr 14
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function
Affected: 9.1.0cu.2024_b20220329
CVE-2023-29798
9.8
2%
Apr 14
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function
Affected: 9.1.0cu.2024_b20220329
CVE-2025-1829
8.8
12%
Mar 2
A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329
Affected: 9.1.0cu.2024_b20220329
CVE-2025-1340
8.8
17%
Feb 16
A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329
Affected: 9.1.0cu.2024_b20220329
CVE-2025-1339
8.8
3%
Feb 16
A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329
Affected: 9.1.0cu.2024_b20220329
CVE-2024-10966
8.8
3%
Nov 7
A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329
Affected: 9.1.0cu.2024_b20220329
Showing 14