CVE-2025-9577 LOW

CVE-2025-9577: TOTOLINK X2000R Administrative shadow.sample default credentials

Vendor Totolink
Product X2000R
Weakness CWE-1392
Published August 28, 2025
Last update August 28, 2025

CVSS base score

2.0/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component Administrative Interface. The manipulation results in use of default credentials. Attacking locally is a requirement. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be exploited.

Key dates

02Disclosure timeline

August 28, 2025 CVE published
August 28, 2025 Record updated