CVE-2025-14586
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user. This manipulation of the argument User causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Risk Assessment
An attacker can remotely execute arbitrary commands on the router, potentially leading to full control of the device and network.
Recommendation
Apply firmware updates from the vendor or restrict access to the device from trusted networks.
Other vulnerabilities in TOTOLINK X5000R
See all- CVE-2026-8137High
A vulnerability has been found in Totolink X5000R version 9.1.0u.6369_B20230113, affecting the function sub_458E40 in the file /boafrm/formDdns. Manipulation of the argument submit-url leads to buffer overflow.
- CVE-2026-37152Critical
TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access. This allows obtaining full access to the device without knowing individual credentials.
- CVE-2023-39617Critical
TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were found to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
- CVE-2023-31569Critical
A command injection vulnerability was discovered in the TOTOLINK X5000R router firmware version V9.1.0cu.2350_B20230313 within the setWanCfg function. An attacker can remotely execute arbitrary system commands without authentication.
- CVE-2023-33487Critical
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setDiagnosisCfg. This vulnerability allows an attacker to execute arbitrary commands through the 'ip' parameter.
- CVE-2023-33486Critical
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command injection vulnerability in the setOpModeCfg function. This vulnerability allows an attacker to execute arbitrary commands through the 'hostName' parameter.
- CVE-2026-91853High
A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-15204Medium
A vulnerability was found in TOTOLINK X5000R versions 9.1.0cu.2415_B20250515 and 9.1.0cu.2350_B20230313 in the exportOvpn function of the /web/cgi-bin/cstecgi.cgi file within the OpenVPN Export component. This vulnerability allows remote path traversal attacks.
- CVE-2025-67445High
A denial-of-service vulnerability exists in the TOTOLINK X5000R router firmware version V9.1.0cu.2415_B20250515 in the CGI script /cgi-bin/cstecgi.cgi. The script reads the CONTENT_LENGTH environment variable and allocates memory using malloc(CONTENT_LENGTH + 1) without proper bounds checking. When the lighttpd request size limit is not enforced, a crafted large POST request can cause memory exhaustion or a segmentation fault, crashing the management CGI and causing loss of web interface availability.
- CVE-2023-33485High
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a post-authentication buffer overflow vulnerability in the addEffect function via the sPort/ePort parameters.
Original NVD description (English source)
A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user. This manipulation of the argument User causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS