Login Request a demo
X5
Product
X5000R
by Totolink · last CVE Sep 15, 2026
73
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities73In the news0Timeline
Severity mix
Critical 24High 40Medium 9Low 0
Severity
All severities73Critical24High40Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add X5000R to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-34921
8.8
9%
May 14
TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function
Affected: 9.1.0cu.2350_b20230313
CVE-2023-33485
8.8
1%
May 31
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort in the addEffect function
Affected: 9.1.0u.6118_b20201102; 9.1.0u.6369_b20230113
CVE-2025-70329
8.0
3%
Feb 23
TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable
Affected: 9.1.0cu.2415_b20250515
CVE-2024-32355
8.0
2%
May 14
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSSServer function
Affected: 9.1.0cu.2350_b20230313
CVE-2024-42736
7.8
2%
Aug 13
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in addBlacklist
Affected: 9.1.0cu.2350_b20230313
CVE-2025-67445
7.5
0%
Feb 24
TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi
Affected: 9.1.0cu.2415_b20250515
CVE-2024-28640
7.5
14%
Mar 16
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause a denial of service (D0S) via the…
Affected: 9.1.0u.6118_b20201102
CVE-2024-25468
7.5
1%
Feb 17
An issue in TOTOLINK X5000R V.9.1.0u.6369_B20230113 allows a remote attacker to cause a denial of service via the host_time parameter of the NTPSyncWithHost component
Affected: 9.1.0u.6369_b20230113
CVE-2023-45985
7.5
1%
Oct 16
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the function setParentalRules
Affected: 9.1.0u.6118_b20201102
CVE-2021-45741
7.5
1%
Feb 4
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setIpv6Cfg
Affected: 9.1.0u.6118_b20201102
CVE-2021-45736
7.5
1%
Feb 4
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setL2tpServerCfg
Affected: 9.1.0u.6118_b20201102
CVE-2021-45735
7.5
4%
Feb 4
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept user credentials via…
Affected: 9.1.0u.6118_b20201102
CVE-2021-45734
7.5
1%
Feb 4
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules
Affected: 9.1.0u.6118_b20201102
CVE-2026-91853
7.4
2%
Sep 15
TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection
Affected: 9.1.0cu.2089_B20211224
CVE-2024-57025
6.8
1%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57024
6.8
2%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWiFiScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-57023
6.8
1%
Jan 15
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2024-42740
6.8
3%
Aug 13
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg
Affected: 9.1.0cu.2350_b20230313
CVE-2025-25605
6.5
1%
Feb 21
Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua
Affected: 9.1.0u.6369_b20230113
CVE-2025-25604
6.5
1%
Feb 21
Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua
Affected: 9.1.0u.6369_b20230113
CVE-2024-32354
6.0
1%
May 14
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'timeout' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi
Affected: 9.1.0cu.2350_b20230313
CVE-2024-32349
6.0
1%
May 14
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu" parameters in the "cstecgi.cgi"…
Affected: 9.1.0cu.2350_b20230313
CVE-2026-15204
5.3
1%
Jul 9
TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal
Affected: 9.1.0cu.2350_B20230313; 9.1.0cu.2415_B20250515
Page 2 of 2 · 73 total
12