TOTOLINK EX200 Extender Vulnerability Allow Attacker to Gain Full

Researchers have warned of a severe vulnerability within the TOTOLINK EX200 Extender Vulnerability Note VU#295169, affects the firmware upload error-handling logic in the End-of-Life TOTOLINK EX200 extender.

When processing malformed firmware files, the device inadvertently enables a root-level telnet service with no authentication.

The vulnerability requires attackers first to gain authenticated access to the device’s web management interface. Once authenticated, attackers can upload malformed firmware files to trigger the error condition.

This activates an unauthenticated telnet service with root privileges, bypassing all security controls.

The telnet interface is usually disabled and not intended for external access, making it an unintended remote administration channel.

Successful exploitation grants complete device control, enabling attackers to execute arbitrary commands and establish persistent network access. A compromised TOTOLINK EX200 could serve as a network entry point.

Attackers may manipulate device configurations, execute unauthorized commands, or maintain long-term network presence. Given the extender’s network position, this vulnerability poses significant risks to connected systems.

According to CERT/CC, TOTOLINK has not released firmware patches, and the EX200 is no longer maintained. Until replacement, organizations should implement these controls:

Restrict management interface access to trusted networks. Implement strong administrative credentials.

Monitor for suspicious telnet activity. Isolate vulnerable devices on separate network segments. Plan immediate device replacement. Owners of TOTOLINK EX200 extenders face an unpatched security risk with no vendor support.

While exploitation requires initial authentication, the subsequent grant of full system access makes this a critical threat that requires urgent remediation through hardware replacement.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.