[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frQpXlZcQ9VPjHcJr4ChJ9YhSj2sUkePwyqfrkFp6DMY":3,"g5a-ex:totolink\u002Fx5000r@*":91,"g5a-family:totolink\u002Fx5000r":93},{"success":4,"data":5},true,{"product":6,"versions":14,"topVulnerabilitiesByEpss":15,"kevVulnerabilities":68,"seoMetadata":69,"meta":88},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":9,"lastCveUpdate":11,"versions":12,"description":13},"totolink","x5000r",0,64,"2025-09-04",[],"X5000r by Totolink is a technology product and 64 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[16,25,30,35,42,47,51,55,60,63],{"cveId":17,"description":18,"publishedDate":19,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":24},"CVE-2023-6612","A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function setDdnsCfg\u002FsetDynamicRoute\u002FsetFirewallType\u002FsetIPSecCfg\u002FsetIpPortFilterRules\u002FsetLancfg\u002FsetLoginPasswordCfg\u002FsetMacFilterRules\u002FsetMtknatCfg\u002FsetNetworkConfig\u002FsetPortForwardRules\u002FsetRemoteCfg\u002FsetSSServer\u002FsetScheduleCfg\u002FsetSmartQosCfg\u002FsetStaticDhcpRules\u002FsetStaticRoute\u002FsetVpnAccountCfg\u002FsetVpnPassCfg\u002FsetVpnUser\u002FsetWiFiAclAddConfig\u002FsetWiFiEasyGuestCfg\u002FsetWiFiGuestCfg\u002FsetWiFiRepeaterConfig\u002FsetWiFiScheduleCfg\u002FsetWizardCfg of the file \u002Fcgi-bin\u002Fcstecgi.cgi. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247247. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","2023-12-08",9.8,"v3.1","Critical",false,0.30683,{"cveId":26,"description":27,"publishedDate":28,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":29},"CVE-2023-30013","TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting\u002FsetTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the \"command\" parameter.","2023-05-05",0.25889,{"cveId":31,"description":32,"publishedDate":33,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":34},"CVE-2022-26213","Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.","2022-03-15",0.2558,{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"cvssVersion":21,"severity":40,"isKev":23,"epssScore":41},"CVE-2024-34921","TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.","2024-05-14",8.8,"High",0.09178,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":46},"CVE-2021-27710","Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, \"ip\" parameter is directly passed to the attacker, allowing them to control the \"ip\" field to attack the OS.","2021-04-14",0.07905,{"cveId":48,"description":49,"publishedDate":45,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":50},"CVE-2021-27708","Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, \"command\" parameter is directly passed to the attacker, allowing them to control the \"command\" field to attack the OS.",0.0761,{"cveId":52,"description":53,"publishedDate":33,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":54},"CVE-2022-27005","Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.",0.05455,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":59},"CVE-2021-45738","TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName.","2022-02-04",0.04391,{"cveId":61,"description":62,"publishedDate":58,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":59},"CVE-2021-45733","TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the parameter host_time.",{"cveId":64,"description":65,"publishedDate":58,"cvssScore":66,"cvssVersion":21,"severity":40,"isKev":23,"epssScore":67},"CVE-2021-45735","TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept user credentials via packet capture software.",7.5,0.03798,[],{"title":70,"metaDescription":71,"keywords":72,"structuredData":73},"X5000r by Totolink - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for X5000r by Totolink with 64 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","X5000r vulnerabilities, X5000r security, X5000r CVE, Totolink X5000r, X5000r threat intelligence, Totolink security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":74,"@type":75,"name":76,"description":71,"url":77,"manufacturer":78,"applicationCategory":82,"softwareVersion":83,"mainEntity":84},"https:\u002F\u002Fschema.org","SoftwareApplication","X5000r","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Ftotolink\u002Fx5000r",{"@type":79,"name":80,"url":81},"Organization","Totolink","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Ftotolink","Security Software","Multiple versions",{"@type":85,"name":86,"description":87,"vulnerabilityCount":10,"dateModified":11},"SecurityVulnerability","X5000r Security Vulnerabilities","Security vulnerabilities affecting X5000r by Totolink",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":9,"lastUpdated":11,"generatedAt":89,"apiVersion":90},"2026-10-18T14:17:39.968Z","3.0",{"rows":92,"total":9,"capped":23,"failed":9},[],[94],{"product":95,"cves":96},"x5000r_firmware",63]