CVE-2025-67445
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A denial-of-service vulnerability exists in the TOTOLINK X5000R router firmware version V9.1.0cu.2415_B20250515 in the CGI script /cgi-bin/cstecgi.cgi. The script reads the CONTENT_LENGTH environment variable and allocates memory using malloc(CONTENT_LENGTH + 1) without proper bounds checking. When the lighttpd request size limit is not enforced, a crafted large POST request can cause memory exhaustion or a segmentation fault, crashing the management CGI and causing loss of web interface availability.
Risk Assessment
An attacker can remotely crash the router's management interface, preventing administrative access and potentially requiring a manual reboot to restore functionality.
Recommendation
Immediately update the TOTOLINK X5000R firmware to the latest version that fixes this vulnerability. If no update is available, restrict access to the management interface to trusted networks and configure a request size limit in the lighttpd server.
Other vulnerabilities in TOTOLINK X5000R
See all- CVE-2026-8137High
A vulnerability has been found in Totolink X5000R version 9.1.0u.6369_B20230113, affecting the function sub_458E40 in the file /boafrm/formDdns. Manipulation of the argument submit-url leads to buffer overflow.
- CVE-2023-39617Critical
TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were found to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
- CVE-2023-31569Critical
A command injection vulnerability was discovered in the TOTOLINK X5000R router firmware version V9.1.0cu.2350_B20230313 within the setWanCfg function. An attacker can remotely execute arbitrary system commands without authentication.
- CVE-2023-33487Critical
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setDiagnosisCfg. This vulnerability allows an attacker to execute arbitrary commands through the 'ip' parameter.
- CVE-2023-33486Critical
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command injection vulnerability in the setOpModeCfg function. This vulnerability allows an attacker to execute arbitrary commands through the 'hostName' parameter.
- CVE-2026-15204Medium
A vulnerability was found in TOTOLINK X5000R versions 9.1.0cu.2415_B20250515 and 9.1.0cu.2350_B20230313 in the exportOvpn function of the /web/cgi-bin/cstecgi.cgi file within the OpenVPN Export component. This vulnerability allows remote path traversal attacks.
- CVE-2023-33485High
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a post-authentication buffer overflow vulnerability in the addEffect function via the sPort/ePort parameters.
Original NVD description (English source)
TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment variable and allocates memory using malloc (CONTENT_LENGTH + 1) without sufficient bounds checking. When lighttpd s request size limit is not enforced, a crafted large POST request can cause memory exhaustion or a segmentation fault, leading to a crash of the management CGI and loss of availability of the web interface.