High severity · published Sep 15, 2026
CVE-2026-91853
TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection
7.4
CVSS
1.8%
EPSS
No
On KEV
Description
A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
X5
X5000R · TOTOLINK
9.1.0cu.2089_B20211224 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91853
github.com
https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/2.md
vuldb.com
https://vuldb.com/cve/CVE-2026-91853
vuldb.com
https://vuldb.com/submit/933810
vuldb.com
https://vuldb.com/vuln/404082
vuldb.com
https://vuldb.com/vuln/404082/cti
www.totolink.net
https://www.totolink.net/
More from X5000R
9.8
CVE-2025-70327
TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable
9.8
CVE-2025-14586
A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224
9.8
CVE-2025-13184
Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113…
9.8
CVE-2025-9934
A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515
9.8
CVE-2024-32353
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi