CVE-2025-70327: totolink x5000r_firmware Argument Injection

Vulnerability summary

CVE-2025-70327 is a critical (CVSS 9.8) Argument Injection vulnerability in totolink x5000r_firmware. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56.2% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 23-02-2026
   PublishedVulnerability first disclosed.
2. 25-02-2026
   Last modifiedVulnerability information updated.

Description

TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The ip parameter is retrieved via websGetVar and passed to a ping command through CsteSystem without validating if the input starts with a hyphen (-). This allows remote authenticated attackers to inject arbitrary command-line options into the ping utility, potentially leading to a Denial of Service (DoS) by causing excessive resource consumption or prolonged execution.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.