CveMateVulnerability intelligence

Totolink X5000R vulnerabilities, page 3

73 vulnerabilities

Known vulnerabilities in Totolink X5000R, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2024-57018totolinkx5000r_firmware1y ago15-01-2025 00:00

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg.CVE-2024-57022totolinkx5000r_firmware1y ago15-01-2025 00:00

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg.CVE-2024-57013totolinkx5000r_firmware1y ago15-01-2025 00:00

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg.CVE-2024-57024totolinkx5000r_firmware1y ago15-01-2025 00:00

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWiFiScheduleCfg.CVE-2024-57011totolinkx5000r_firmware1y ago15-01-2025 00:00

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg.CVE-2024-57012totolinkx5000r_firmware1y ago15-01-2025 00:00

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.CVE-2024-57020totolinkx5000r_firmware1y ago15-01-2025 00:00

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg.CVE-2024-57023totolinkx5000r_firmware1y ago15-01-2025 00:00

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg.CVE-2024-28640totolinka7000r_firmware+12y ago16-03-2024 00:00

Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause a denial of service (D0S) via the command field.CVE-2024-28639totolinka7000r_firmware+12y ago16-03-2024 00:00

Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and cause a denial of service (DoS) via the IP field.CVE-2024-32351totolinkx5000r_firmware2y ago14-05-2024 15:56

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mru" parameter in the "cstecgi.cgi" binary.CVE-2024-32355totolinkx5000r_firmware2y ago14-05-2024 16:00

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSSServer function.CVE-2024-32354totolinkx5000r_firmware2y ago14-05-2024 15:59

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'timeout' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi.CVE-2024-32353totolinkx5000r_firmware2y ago14-05-2024 15:58

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi.CVE-2024-32349totolinkx5000r_firmware2y ago14-05-2024 15:52

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu" parameters in the "cstecgi.cgi" binary.CVE-2024-32350totolinkx5000r_firmware2y ago14-05-2024 15:55

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecPsk" parameter in the "cstecgi.cgi" binary.CVE-2024-32352totolinkx5000r_firmware2y ago14-05-2024 15:57

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecL2tpEnable" parameter in the "cstecgi.cgi" binary.CVE-2024-34921totolinkx5000r_firmware2y ago13-05-2024 19:23

TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.CVE-2026-91853totolinkx5000r_firmware1mo ago15-09-2026 16:15

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.CVE-2026-15204totolinkx5000r_firmware3mo ago09-07-2026 17:45

A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin/cstecgi.cgi of the component OpenVPN Export. The manipulation results in path traversal. The attack may be launched remotely.