CVE-2025-13184

Critical · 9.8

CVSS

9.8

EPSS

11.3%

Published

Dec 10, 2025

CISA due date

—

The record

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.

Affected packages

Ecosystem	Package	Introduced	Fixed