CVE-2026-15204
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability was found in TOTOLINK X5000R versions 9.1.0cu.2415_B20250515 and 9.1.0cu.2350_B20230313 in the exportOvpn function of the /web/cgi-bin/cstecgi.cgi file within the OpenVPN Export component. This vulnerability allows remote path traversal attacks.
Risk Assessment
An attacker can remotely read arbitrary files on the system, potentially leading to the leakage of sensitive information such as network configurations or credentials.
Recommendation
Immediately update the TOTOLINK X5000R firmware to the latest available version that fixes this vulnerability. If an update is not available, restrict access to the management interface to trusted networks only.
Other vulnerabilities in TOTOLINK X5000R
See all- CVE-2026-8137High
A vulnerability has been found in Totolink X5000R version 9.1.0u.6369_B20230113, affecting the function sub_458E40 in the file /boafrm/formDdns. Manipulation of the argument submit-url leads to buffer overflow.
- CVE-2023-39617Critical
TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were found to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
- CVE-2023-31569Critical
A command injection vulnerability was discovered in the TOTOLINK X5000R router firmware version V9.1.0cu.2350_B20230313 within the setWanCfg function. An attacker can remotely execute arbitrary system commands without authentication.
- CVE-2023-33487Critical
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setDiagnosisCfg. This vulnerability allows an attacker to execute arbitrary commands through the 'ip' parameter.
- CVE-2023-33486Critical
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command injection vulnerability in the setOpModeCfg function. This vulnerability allows an attacker to execute arbitrary commands through the 'hostName' parameter.
- CVE-2025-67445High
A denial-of-service vulnerability exists in the TOTOLINK X5000R router firmware version V9.1.0cu.2415_B20250515 in the CGI script /cgi-bin/cstecgi.cgi. The script reads the CONTENT_LENGTH environment variable and allocates memory using malloc(CONTENT_LENGTH + 1) without proper bounds checking. When the lighttpd request size limit is not enforced, a crafted large POST request can cause memory exhaustion or a segmentation fault, crashing the management CGI and causing loss of web interface availability.
- CVE-2023-33485High
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a post-authentication buffer overflow vulnerability in the addEffect function via the sPort/ePort parameters.
Original NVD description (English source)
A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin/cstecgi.cgi of the component OpenVPN Export. The manipulation results in path traversal. The attack may be launched remotely.