← Back

X5000r Firmware

x5000r_firmware

Vendor: Totolink • 70 CVEs

CVEs (70)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-32350
1Totolink
1X5000r Firmware
Apr 4, 2025
May 14, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecPsk" parameter in the "cstecgi.cgi" binary.
CVE-2024-32349
1Totolink
1X5000r Firmware
Apr 4, 2025
May 14, 2024
N/A· v4
6.0 MEDIUM· v3
N/A· v2
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu" parameters in the "cstecgi.cgi" binary.
CVE-2024-34921
1Totolink
1X5000r Firmware
Apr 4, 2025
May 14, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.
CVE-2024-28640
1Totolink
2A7000r Firmware
X5000r Firmware
Jun 27, 2025
Mar 16, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause a denial of service (D0S) via the command field.
CVE-2024-28639
1Totolink
2A7000r Firmware
X5000r Firmware
Mar 26, 2025
Mar 16, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and cause a denial of service (DoS) via the IP field.
CVE-2024-25468
1Totolink
1X5000r Firmware
Mar 28, 2025
Feb 17, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in TOTOLINK X5000R V.9.1.0u.6369_B20230113 allows a remote attacker to cause a denial of service via the host_time parameter of the NTPSyncWithHost component.
CVE-2023-6612
1Totolink
1X5000r Firmware
Nov 21, 2024
Dec 8, 2023
N/A· v4
9.8 CRITICAL· v3
5.2 MEDIUM· v2
A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function setDdnsCfg/setDynamicRoute/setFirewallType/setIPSecCfg/setIpPortFilterRules/setLancfg/se...Show more
A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function setDdnsCfg/setDynamicRoute/setFirewallType/setIPSecCfg/setIpPortFilterRules/setLancfg/setLoginPasswordCfg/setMacFilterRules/setMtknatCfg/setNetworkConfig/setPortForwardRules/setRemoteCfg/setSSServer/setScheduleCfg/setSmartQosCfg/setStaticDhcpRules/setStaticRoute/setVpnAccountCfg/setVpnPassCfg/setVpnUser/setWiFiAclAddConfig/setWiFiEasyGuestCfg/setWiFiGuestCfg/setWiFiRepeaterConfig/setWiFiScheduleCfg/setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247247. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-45985
1Totolink
2A7000r Firmware
X5000r Firmware
Nov 21, 2024
Oct 16, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Ser...Show more
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.Show less
CVE-2023-45984
1Totolink
2A7000r Firmware
X5000r Firmware
Nov 21, 2024
Oct 16, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.
CVE-2023-36950
1Totolink
2A7000r Firmware
X5000r Firmware
Nov 21, 2024
Oct 16, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
CVE-2023-36947
1Totolink
2A7000r Firmware
X5000r Firmware
Nov 21, 2024
Oct 16, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
CVE-2023-39618
1Totolink
1X5000r Firmware
Nov 21, 2024
Aug 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.
CVE-2023-39617
1Totolink
1X5000r Firmware
Nov 21, 2024
Aug 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
CVE-2023-31569
1Totolink
1X5000r Firmware
Jan 8, 2025
Jun 6, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.
CVE-2023-33487
1Totolink
1X5000r Firmware
Jan 9, 2025
May 31, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attacker to execute arbitrary commands through the "ip" paramet...Show more
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attacker to execute arbitrary commands through the "ip" parameter.Show less
CVE-2023-33486
1Totolink
1X5000r Firmware
Jan 9, 2025
May 31, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attacker to execute arbitrary commands through the "hostName" para...Show more
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attacker to execute arbitrary commands through the "hostName" parameter.Show less
CVE-2023-33485
1Totolink
1X5000r Firmware
Jan 10, 2025
May 31, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort in the addEffect function.
CVE-2023-30013
1Totolink
1X5000r Firmware
Jan 29, 2025
May 5, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "co...Show more
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.Show less
CVE-2022-27005
1Totolink
2A7000r Firmware
X5000r Firmware
Nov 21, 2024
Mar 15, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability all...Show more
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.Show less
CVE-2022-27004
1Totolink
2A7000r Firmware
X5000r Firmware
Nov 21, 2024
Mar 15, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability...Show more
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.Show less