CVE-2026-91853
HighCVSS 7.4Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, taking full control. The publicly available exploit increases the risk of rapid exploitation.
Recommendation
Update the device firmware to the latest version or restrict access to the management interface. If no patch is available, consider disabling the service or network segmentation.
Other vulnerabilities in TOTOLINK X5000R
See all- CVE-2026-8137High
A vulnerability has been found in Totolink X5000R version 9.1.0u.6369_B20230113, affecting the function sub_458E40 in the file /boafrm/formDdns. Manipulation of the argument submit-url leads to buffer overflow.
- CVE-2026-37152Critical
TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access. This allows obtaining full access to the device without knowing individual credentials.
- CVE-2023-39617Critical
TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were found to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
- CVE-2023-31569Critical
A command injection vulnerability was discovered in the TOTOLINK X5000R router firmware version V9.1.0cu.2350_B20230313 within the setWanCfg function. An attacker can remotely execute arbitrary system commands without authentication.
- CVE-2023-33487Critical
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setDiagnosisCfg. This vulnerability allows an attacker to execute arbitrary commands through the 'ip' parameter.
- CVE-2023-33486Critical
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command injection vulnerability in the setOpModeCfg function. This vulnerability allows an attacker to execute arbitrary commands through the 'hostName' parameter.
- CVE-2026-15204Medium
A vulnerability was found in TOTOLINK X5000R versions 9.1.0cu.2415_B20250515 and 9.1.0cu.2350_B20230313 in the exportOvpn function of the /web/cgi-bin/cstecgi.cgi file within the OpenVPN Export component. This vulnerability allows remote path traversal attacks.
- CVE-2025-67445High
A denial-of-service vulnerability exists in the TOTOLINK X5000R router firmware version V9.1.0cu.2415_B20250515 in the CGI script /cgi-bin/cstecgi.cgi. The script reads the CONTENT_LENGTH environment variable and allocates memory using malloc(CONTENT_LENGTH + 1) without proper bounds checking. When the lighttpd request size limit is not enforced, a crafted large POST request can cause memory exhaustion or a segmentation fault, crashing the management CGI and causing loss of web interface availability.
- CVE-2023-33485High
TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a post-authentication buffer overflow vulnerability in the addEffect function via the sPort/ePort parameters.
Original NVD description (English source)
A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.