Vulnerabilities

Filters

Reset all

2 selected

70 records

Sort

Vendor: TOTOLINK Component: X5000r Firmware Clear all filters

TI-2025-41217 CVE-2025-67445 · GHSA-v5qr-j3c6-xxx2

TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in…

LOW 33

TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00371 Published 2026-02-24 No fix listed CWE-400

TI-2025-43099 CVE-2025-70329 · GHSA-h4x3-hcxh-84cx

TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in…

HIGH 70

TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.03438 Published 2026-02-23 No fix listed CWE-78

TI-2025-43097 CVE-2025-70327 · GHSA-p9m7-fwrr-649p

TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in…

HIGH 82

TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00805 Published 2026-02-23 No fix listed CWE-400

TI-2025-13327 CVE-2025-14586 · GHSA-g5qq-5f56-7h93

TOTOLINK X5000R cstecgi.cgi snprintf os command injection

MEDIUM 57

A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.02758 Published 2025-12-13 No fix listed CWE-77

TI-2025-12054 CVE-2025-13184 · GHSA-xr55-5xvm-9rw7

Incorrect authorization in TOTOLINK X5000R's

HIGH 82

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20087 Published 2025-12-10 Fixed in V9.1.0u.6369_B20230113 CWE-863

TI-2025-09115 CVE-2025-9934 · GHSA-gp98-6pwv-9cmv

TOTOLINK X5000R cstecgi.cgi sub_410C34 command injection

HIGH 65

A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.03402 Published 2025-09-03 No fix listed CWE-74

TI-2025-19064 CVE-2025-25605 · GHSA-xrf3-35rj-g634

Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the…

LOW 32

Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00791 Published 2025-02-21 No fix listed CWE-77

TI-2025-19063 CVE-2025-25604 · GHSA-hc6p-5pr7-xvv5

Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.

LOW 32

Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00791 Published 2025-02-21 No fix listed CWE-77

TI-2024-37755 CVE-2024-57025 · GHSA-c5gc-hxmh-64hw

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 65

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiScheduleCfg.

CVSS 3.1MEDIUM 6.8 Adjacent network High privileges No interaction EPSS 0.01393 Published 2025-01-15 No fix listed CWE-78

TI-2024-37754 CVE-2024-57024 · GHSA-h8r3-h3c2-pp25

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 65

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWiFiScheduleCfg.

CVSS 3.1MEDIUM 6.8 Adjacent network High privileges No interaction EPSS 0.01549 Published 2025-01-15 No fix listed CWE-78

TI-2024-37753 CVE-2024-57023 · GHSA-c96m-hgv3-chpf

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 65

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg.

CVSS 3.1MEDIUM 6.8 Adjacent network High privileges No interaction EPSS 0.01393 Published 2025-01-15 No fix listed CWE-78

TI-2024-37752 CVE-2024-57022 · GHSA-89gw-cghg-xxj8

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 79

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0165 Published 2025-01-15 No fix listed CWE-78

TI-2024-37751 CVE-2024-57021 · GHSA-wp9g-p59f-6fmw

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 73

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFiScheduleCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0165 Published 2025-01-15 No fix listed CWE-78

TI-2024-37750 CVE-2024-57020 · GHSA-mqpq-866q-4xr5

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 73

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0165 Published 2025-01-15 No fix listed CWE-78

TI-2024-37749 CVE-2024-57019 · GHSA-86hg-8qx9-pcjm

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 79

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0165 Published 2025-01-15 No fix listed CWE-78

TI-2024-37748 CVE-2024-57018 · GHSA-wqjm-248p-mph4

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 79

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0165 Published 2025-01-15 No fix listed CWE-78

TI-2024-37747 CVE-2024-57017 · GHSA-85mx-pqv6-r46j

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 79

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0165 Published 2025-01-15 No fix listed CWE-78

TI-2024-37746 CVE-2024-57016 · GHSA-mx37-rcg6-jwqh

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 79

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0165 Published 2025-01-15 No fix listed CWE-78

TI-2024-37745 CVE-2024-57015 · GHSA-xq2j-2jwj-gfcq

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 79

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0165 Published 2025-01-15 No fix listed CWE-78

TI-2024-37744 CVE-2024-57014 · GHSA-9pv3-7hg6-7xj7

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 73

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01211 Published 2025-01-15 No fix listed CWE-78

TI-2024-37743 CVE-2024-57013 · GHSA-g3x2-jq2q-7r55

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 79

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0165 Published 2025-01-15 No fix listed CWE-78

TI-2024-37742 CVE-2024-57012 · GHSA-hg7g-25jg-2gmw

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 79

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0165 Published 2025-01-15 No fix listed CWE-78

TI-2024-37741 CVE-2024-57011 · GHSA-qrj7-mr7g-fh9r

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection…

HIGH 79

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01793 Published 2025-01-15 No fix listed CWE-78

TI-2024-28590 CVE-2024-42740 · GHSA-jcvv-37v4-9r3f

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS…

HIGH 65

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg.

CVSS 3.1MEDIUM 6.8 Adjacent network High privileges No interaction EPSS 0.02737 Published 2024-08-13 No fix listed CWE-78

TI-2024-28589 CVE-2024-42739 · GHSA-r979-6ffq-pvxw

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS…

HIGH 73

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01647 Published 2024-08-13 No fix listed CWE-94