Login Request a demo
X5
Product
X5000R
by Totolink · last CVE Sep 15, 2026
73
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities73In the news0Timeline
Severity mix
Critical 24High 40Medium 9Low 0
Severity
All severities73Critical24High40Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add X5000R to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-70327
9.8
1%
Feb 23
TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable
Affected: 9.1.0cu.2415_b20250515
CVE-2025-14586
9.8
3%
Dec 13
TOTOLINK X5000R cstecgi.cgi snprintf os command injection
Affected: 9.1.0cu.2089_B20211224
CVE-2025-13184
9.8
20%
Dec 10
Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password
Affected: 9.1.0u.6369_b20230113
CVE-2025-9934
9.8
3%
Sep 3
TOTOLINK X5000R cstecgi.cgi sub_410C34 command injection
Affected: 9.1.0cu.2415_b20250515
CVE-2024-32353
9.8
2%
May 14
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi
Affected: 9.1.0cu.2350_b20230313
CVE-2024-28639
9.8
1%
Mar 16
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and cause a denial of…
Affected: 9.1.0u.6118_b20201102
CVE-2023-6612
9.8
31%
Dec 8
A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112
Affected: 9.1.0cu.2300_b20230112
CVE-2023-45984
9.8
1%
Oct 16
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg
Affected: 9.1.0u.6118_b20201102
CVE-2023-36950
9.8
1%
Oct 16
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth
Affected: 9.1.0u.6118_b20201102
CVE-2023-36947
9.8
1%
Oct 16
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function…
Affected: 9.1.0u.6118_b20201102
CVE-2023-39618
9.8
2%
Aug 21
TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface
Affected: b20210419
CVE-2023-39617
9.8
2%
Aug 21
TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang parameter in the…
Affected: 9.1.0cu.2089_b20211224; 9.1.0cu.2350_b20230313
CVE-2023-31569
9.8
3%
Jun 6
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function
Affected: 9.1.0cu.2350_b20230313
CVE-2023-33487
9.8
1%
May 31
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attacker to execute…
Affected: 9.1.0u.6118_b20201102; 9.1.0u.6369_b20230113
CVE-2023-33486
9.8
1%
May 31
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg
Affected: 9.1.0u.6118_b20201102; 9.1.0u.6369_b20230113
CVE-2023-30013
9.8
26%
May 5
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg
Affected: 9.1.0u.6118_b20201102; 9.1.0u.6369_b20230113
CVE-2022-27005
9.8
5%
Mar 15
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the…
Affected: 9.1.0u.6118_b20201102
CVE-2022-27004
9.8
3%
Mar 15
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the…
Affected: 9.1.0u.6118_b20201102
CVE-2022-27003
9.8
3%
Mar 15
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the…
Affected: 9.1.0u.6118_b20201102
CVE-2022-26213
9.8
26%
Mar 15
Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters
Affected: 9.1.0u.6118_b20201102
CVE-2021-45738
9.8
4%
Feb 4
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile
Affected: 9.1.0u.6118_b20201102
CVE-2021-45733
9.8
4%
Feb 4
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost
Affected: 9.1.0u.6118_b20201102
CVE-2021-27710
9.8
8%
Apr 14
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute…
Affected: 9.1.0u.6118_b20201102
CVE-2021-27708
9.8
8%
Apr 14
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute…
Affected: 9.1.0u.6118_b20201102
CVE-2026-8137
8.8
0%
May 8
Totolink X5000R formDdns sub_458E40 buffer overflow
Affected: 9.1.0u.6369_B20230113
CVE-2024-57022
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57021
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFiScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57020
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57019
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57018
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57017
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57016
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57015
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57014
8.8
1%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57013
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57012
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57011
8.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-42739
8.8
2%
Aug 13
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg
Affected: 9.1.0u.6369_b20230113
CVE-2024-42738
8.8
2%
Aug 13
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg
Affected: 9.1.0u.6369_b20230113
CVE-2024-42737
8.8
2%
Aug 13
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist
Affected: 9.1.0u.6369_b20230113
CVE-2024-42748
8.8
2%
Aug 12
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg
Affected: 9.1.0u.6369_b20230113
CVE-2024-42747
8.8
1%
Aug 12
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg
Affected: 9.1.0u.6369_b20230113
CVE-2024-42745
8.8
2%
Aug 12
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg
Affected: 9.1.0u.6369_b20230113
CVE-2024-42744
8.8
2%
Aug 12
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser
Affected: 9.1.0u.6369_b20230113
CVE-2024-42743
8.8
2%
Aug 12
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg
Affected: 9.1.0u.6369_b20230113
CVE-2024-42742
8.8
2%
Aug 12
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules
Affected: 9.1.0u.6369_b20230113
CVE-2024-42741
8.8
1%
Aug 12
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg
Affected: 9.1.0u.6369_b20230113
CVE-2024-32352
8.8
2%
May 14
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecL2tpEnable" parameter in the…
Affected: 9.1.0cu.2350_b20230313
CVE-2024-32351
8.8
2%
May 14
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mru" parameter in the "cstecgi.cgi" binary
Affected: 9.1.0cu.2350_b20230313
CVE-2024-32350
8.8
2%
May 14
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecPsk" parameter in the "cstecgi.cgi"…
Affected: 9.1.0cu.2350_b20230313
Page 1 of 2 · 73 total
12