X5000r (Totolink) - vulnerabilities (CVEs)
5 CVEs, 0 in the last 30 days, 6 known versions, newest CVE from 2025-09-04. Vendor: Totolink.
CVEs of X5000r
- CVE-2025-9934 - CVSS 9.8 (critical), 2025-09-04: A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. Performing…
- CVE-2024-42739 - CVSS 8.8 (high), 2024-08-13: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg. Authenticated…
- CVE-2024-42745 - CVSS 9.8 (critical), 2024-08-12: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated…
- CVE-2024-32352 - CVSS 8.8 (high), 2024-05-14: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecL2tpEnable"…
- CVE-2024-32353 - CVSS 9.8 (critical), 2024-05-14: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSServer function at…
- CVE-2023-6612 - CVSS 9.8 (critical), 2023-12-08: A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function…
- CVE-2023-39618 - CVSS 9.8 (critical), 2023-08-21: TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.
- CVE-2023-39617 - CVSS 9.8 (critical), 2023-08-21: TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang…
