X5000r Firmware (Totolink) - vulnerabilities (CVEs)

73 CVEs, 0 in the last 30 days, 8 known versions, newest CVE from 2026-09-15. Vendor: Totolink.

CVEs of X5000r Firmware

• CVE-2026-91853 - CVSS 7.4 (high), 2026-09-15: A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file…
• CVE-2026-15204 - CVSS 6.9 (medium), 2026-07-09: A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230313. Affected by this vulnerability is the function exportOvpn of…
• CVE-2026-8137 - CVSS 8.8 (high), 2026-05-08: A vulnerability has been found in Totolink X5000R 9.1.0u.6369_B20230113. This vulnerability affects the function sub_458E40 of the file /boafrm/formDdns. The…
• CVE-2025-67445 - CVSS 7.5 (high), 2026-02-24: TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment…
• CVE-2025-70327 - CVSS 9.8 (critical), 2026-02-23: TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The…
• CVE-2025-70329 - CVSS 8 (high), 2026-02-23: TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The…
• CVE-2025-14586 - CVSS 9.8 (critical), 2025-12-13: A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function snprintf of the file…
• CVE-2025-13184 - CVSS 9.8 (critical), 2025-12-10: Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R…
• CVE-2025-9934 - CVSS 9.8 (critical), 2025-09-04: A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. Performing…
• CVE-2025-25604 - CVSS 6.5 (medium), 2025-02-21: Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.
• CVE-2025-25605 - CVSS 6.5 (medium), 2025-02-21: Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua.
• CVE-2024-57023 - CVSS 6.8 (medium), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg.
• CVE-2024-57022 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg.
• CVE-2024-57025 - CVSS 6.8 (medium), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiScheduleCfg.
• CVE-2024-57024 - CVSS 6.8 (medium), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWiFiScheduleCfg.
• CVE-2024-57017 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg.
• CVE-2024-57020 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg.
• CVE-2024-57013 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg.
• CVE-2024-57016 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg.
• CVE-2024-57019 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg.
• CVE-2024-57012 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.
• CVE-2024-57015 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg.
• CVE-2024-57018 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg.
• CVE-2024-57021 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFiScheduleCfg.
• CVE-2024-57011 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg.
• CVE-2024-57014 - CVSS 8.8 (high), 2025-01-15: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.
• CVE-2024-42740 - CVSS 6.8 (medium), 2024-08-13: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg. Authenticated Attackers…
• CVE-2024-42737 - CVSS 9.8 (critical), 2024-08-13: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist. Authenticated…
• CVE-2024-42736 - CVSS 7.8 (high), 2024-08-13: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in addBlacklist. Authenticated…
• CVE-2024-42739 - CVSS 8.8 (high), 2024-08-13: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg. Authenticated…
• CVE-2024-42738 - CVSS 8.8 (high), 2024-08-13: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg. Authenticated Attackers…
• CVE-2024-42743 - CVSS 8.8 (high), 2024-08-12: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg . Authenticated…
• CVE-2024-42747 - CVSS 8.8 (high), 2024-08-12: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated…
• CVE-2024-42745 - CVSS 9.8 (critical), 2024-08-12: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated…
• CVE-2024-42744 - CVSS 8.8 (high), 2024-08-12: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser. Authenticated…
• CVE-2024-42748 - CVSS 9.8 (critical), 2024-08-12: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. Authenticated…
• CVE-2024-42742 - CVSS 8.8 (high), 2024-08-12: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules. Authenticated…
• CVE-2024-42741 - CVSS 8.8 (high), 2024-08-12: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated…
• CVE-2024-32354 - CVSS 6 (medium), 2024-05-14: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'timeout' parameter in the setSSServer function at…
• CVE-2024-32353 - CVSS 9.8 (critical), 2024-05-14: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSServer function at…
• CVE-2024-32352 - CVSS 8.8 (high), 2024-05-14: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecL2tpEnable"…
• CVE-2024-32355 - CVSS 8 (high), 2024-05-14: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSSServer function.
• CVE-2024-32351 - CVSS 8.8 (high), 2024-05-14: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mru" parameter in the…
• CVE-2024-32350 - CVSS 8.8 (high), 2024-05-14: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecPsk" parameter…
• CVE-2024-32349 - CVSS 6 (medium), 2024-05-14: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu" parameters in…
• CVE-2024-34921 - CVSS 8.8 (high), 2024-05-14: TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.
• CVE-2024-28640 - CVSS 7.5 (high), 2024-03-16: Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause a denial of…
• CVE-2024-28639 - CVSS 9.8 (critical), 2024-03-16: Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code…
• CVE-2024-25468 - CVSS 7.5 (high), 2024-02-17: An issue in TOTOLINK X5000R V.9.1.0u.6369_B20230113 allows a remote attacker to cause a denial of service via the host_time parameter of the NTPSyncWithHost…
• CVE-2023-6612 - CVSS 9.8 (critical), 2023-12-08: A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function…
• CVE-2023-45984 - CVSS 9.8 (critical), 2023-10-16: TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the…
• CVE-2023-45985 - CVSS 7.5 (high), 2023-10-16: TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the function…
• CVE-2023-36950 - CVSS 9.8 (critical), 2023-10-16: TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in…
• CVE-2023-36947 - CVSS 9.8 (critical), 2023-10-16: TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the…
• CVE-2023-39617 - CVSS 9.8 (critical), 2023-08-21: TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang…
• CVE-2023-39618 - CVSS 9.8 (critical), 2023-08-21: TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.
• CVE-2023-31569 - CVSS 9.8 (critical), 2023-06-06: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.
• CVE-2023-33486 - CVSS 9.8 (critical), 2023-05-31: TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an…
• CVE-2023-33485 - CVSS 8.8 (high), 2023-05-31: TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort in the addEffect…
• CVE-2023-33487 - CVSS 9.8 (critical), 2023-05-31: TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an…
• CVE-2023-30013 - CVSS 9.8 (critical), 2023-05-05: TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability…
• CVE-2022-27005 - CVSS 9.8 (critical), 2022-03-15: Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the…
• CVE-2022-27004 - CVSS 9.8 (critical), 2022-03-15: Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel…
• CVE-2022-27003 - CVSS 9.8 (critical), 2022-03-15: Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel…
• CVE-2022-26213 - CVSS 9.8 (critical), 2022-03-15: Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters.…
• CVE-2021-45736 - CVSS 7.5 (high), 2022-02-04: TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setL2tpServerCfg. This vulnerability allows attackers to…
• CVE-2021-45735 - CVSS 7.5 (high), 2022-02-04: TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept…
• CVE-2021-45741 - CVSS 7.5 (high), 2022-02-04: TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setIpv6Cfg. This vulnerability allows attackers to cause a…
• CVE-2021-45734 - CVSS 7.5 (high), 2022-02-04: TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to…
• CVE-2021-45738 - CVSS 9.8 (critical), 2022-02-04: TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability…
• CVE-2021-45733 - CVSS 9.8 (critical), 2022-02-04: TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows…
• CVE-2021-27710 - CVSS 9.8 (critical), 2021-04-14: Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote…
• CVE-2021-27708 - CVSS 9.8 (critical), 2021-04-14: Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote…