Read the docs
TI-2025-43099 Aliases CVE-2025-70329GHSA-h4x3-hcxh-84cx

TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in…

Priority HIGH 70CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.

Summary

TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlanVidLan1 (and other vlanVidLanX) parameters are retrieved via Uci_Get_Str and passed to the CsteSystem function without adequate validation or filtering. This allows an authenticated attacker to execute arbitrary shell commands with root privileges by injecting shell metacharacters into the affected parameters.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03438 89th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:totolink:x5000r_firmware:9.1.0cu.2415_b20250515:*:*:*:*:*:*:*9.1.0cu.2415_b20250515VulnerableTOTOLINK
cpe:2.3:h:totolink:x5000r:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
  • cpe:2.3:o:totolink:x5000r_firmware:9.1.0cu.2415_b20250515:*:*:*:*:*:*:* Versions 9.1.0cu.2415_b20250515 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:x5000r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-70329
  2. 2026-10-03 Alias added: GHSA-h4x3-hcxh-84cx

References

Exploit 2

  • TI-2025-43097 TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in… CVSS 3.1CRITICAL 9.8
  • TI-2025-12054 Incorrect authorization in TOTOLINK X5000R's CVSS 3.1CRITICAL 9.8
  • TI-2024-28597 In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS… CVSS 3.1CRITICAL 9.8
  • TI-2024-28595 In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS… CVSS 3.1CRITICAL 9.8
  • TI-2024-28587 In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS… CVSS 3.1CRITICAL 9.8
  • TI-2024-21298 TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection… CVSS 3.1CRITICAL 9.8
See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences