TOTOLINK EX200 Vulnerable to Remote Takeover

Unpatched Firmware Flaw Leaves Wireless Extenders Exposed

Apr. 10, 2026 at 6:14pm

Got story updates? Submit your updates here. ›

A highly detailed, glowing 3D macro illustration of a TOTOLINK EX200 wireless range extender, its internal components illuminated by neon cyan and magenta lights, representing the vulnerability and risk of remote takeover.A vulnerable TOTOLINK EX200 wireless extender glows with the threat of remote takeover, exposing the need for better long-term security support from manufacturers.Today in Miami

A critical security vulnerability has been uncovered in TOTOLINK EX200 wireless range extenders, putting the devices at risk of full remote takeover. The unpatched flaw, CVE-2025-65606, allows an authenticated attacker to gain root-level access and control the device. However, successful exploitation requires initial access to the web management interface, making it an insider threat scenario.

Why it matters

The lack of a firmware patch from TOTOLINK is concerning, as the EX200 model is no longer actively maintained. This leaves users with an unsupported device and no official fix, raising questions about manufacturer accountability for long-term security and support.

The details

The vulnerability lies in the firmware-upload error-handling logic, which can be triggered by an authenticated attacker to start an unauthenticated root-level telnet service. This essentially hands over full system access, allowing the attacker to manipulate configurations, execute arbitrary commands, and establish persistence on the device.

  • The last firmware update for the EX200 was in February 2023.

The players

TOTOLINK

An American wireless networking equipment manufacturer that produced the vulnerable EX200 range extender.

CVE-2025-65606

The unpatched firmware vulnerability that allows remote takeover of TOTOLINK EX200 devices.

Got photos? Submit your photos here. ›

What’s next

With no patches forthcoming, users are advised to restrict administrative access, monitor for suspicious activity, and consider upgrading to a supported model.

The takeaway

This vulnerability highlights the importance of long-term security support and updates from manufacturers, especially for connected devices. The lack of a fix puts users at risk and raises questions about accountability in the tech industry.