[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHsk0RN25tCLY1AvoylwBe0ouL_bVB-rIRLvlsukqYe4":3,"g5a-ex:totolink\u002Fx5000r_firmware@*":114,"g5a-family:totolink\u002Fx5000r_firmware":116},{"success":4,"data":5},true,{"product":6,"versions":32,"topVulnerabilitiesByEpss":39,"kevVulnerabilities":91,"seoMetadata":92,"meta":111},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":31},"totolink","x5000r_firmware",6,63,0,"2025-02-21",[14,18,20,23,26,29],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"9.1.0cu.2089_b20211224",1,false,{"version":19,"cve_count":16,"kev_count":11,"has_kev":17},"9.1.0cu.2300_b20230112",{"version":21,"cve_count":22,"kev_count":11,"has_kev":17},"9.1.0cu.2350_b20230313",27,{"version":24,"cve_count":25,"kev_count":11,"has_kev":17},"9.1.0u.6118_b20201102",21,{"version":27,"cve_count":28,"kev_count":11,"has_kev":17},"9.1.0u.6369_b20230113",17,{"version":30,"cve_count":16,"kev_count":11,"has_kev":17},"b20210419","X5000r Firmware by Totolink is a technology product with 6 tracked versions and 63 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[33,34,35,36,37,38],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":16,"kev_count":11,"has_kev":17},{"version":21,"cve_count":22,"kev_count":11,"has_kev":17},{"version":24,"cve_count":25,"kev_count":11,"has_kev":17},{"version":27,"cve_count":28,"kev_count":11,"has_kev":17},{"version":30,"cve_count":16,"kev_count":11,"has_kev":17},[40,48,53,58,65,70,74,78,83,86],{"cveId":41,"description":42,"publishedDate":43,"cvssScore":44,"cvssVersion":45,"severity":46,"isKev":17,"epssScore":47},"CVE-2023-6612","A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function setDdnsCfg\u002FsetDynamicRoute\u002FsetFirewallType\u002FsetIPSecCfg\u002FsetIpPortFilterRules\u002FsetLancfg\u002FsetLoginPasswordCfg\u002FsetMacFilterRules\u002FsetMtknatCfg\u002FsetNetworkConfig\u002FsetPortForwardRules\u002FsetRemoteCfg\u002FsetSSServer\u002FsetScheduleCfg\u002FsetSmartQosCfg\u002FsetStaticDhcpRules\u002FsetStaticRoute\u002FsetVpnAccountCfg\u002FsetVpnPassCfg\u002FsetVpnUser\u002FsetWiFiAclAddConfig\u002FsetWiFiEasyGuestCfg\u002FsetWiFiGuestCfg\u002FsetWiFiRepeaterConfig\u002FsetWiFiScheduleCfg\u002FsetWizardCfg of the file \u002Fcgi-bin\u002Fcstecgi.cgi. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247247. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","2023-12-08",9.8,"v3.1","Critical",0.30683,{"cveId":49,"description":50,"publishedDate":51,"cvssScore":44,"cvssVersion":45,"severity":46,"isKev":17,"epssScore":52},"CVE-2023-30013","TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting\u002FsetTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the \"command\" parameter.","2023-05-05",0.25889,{"cveId":54,"description":55,"publishedDate":56,"cvssScore":44,"cvssVersion":45,"severity":46,"isKev":17,"epssScore":57},"CVE-2022-26213","Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.","2022-03-15",0.2558,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"cvssVersion":45,"severity":63,"isKev":17,"epssScore":64},"CVE-2024-34921","TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.","2024-05-14",8.8,"High",0.09178,{"cveId":66,"description":67,"publishedDate":68,"cvssScore":44,"cvssVersion":45,"severity":46,"isKev":17,"epssScore":69},"CVE-2021-27710","Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, \"ip\" parameter is directly passed to the attacker, allowing them to control the \"ip\" field to attack the OS.","2021-04-14",0.07905,{"cveId":71,"description":72,"publishedDate":68,"cvssScore":44,"cvssVersion":45,"severity":46,"isKev":17,"epssScore":73},"CVE-2021-27708","Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, \"command\" parameter is directly passed to the attacker, allowing them to control the \"command\" field to attack the OS.",0.0761,{"cveId":75,"description":76,"publishedDate":56,"cvssScore":44,"cvssVersion":45,"severity":46,"isKev":17,"epssScore":77},"CVE-2022-27005","Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.",0.05455,{"cveId":79,"description":80,"publishedDate":81,"cvssScore":44,"cvssVersion":45,"severity":46,"isKev":17,"epssScore":82},"CVE-2021-45738","TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName.","2022-02-04",0.04391,{"cveId":84,"description":85,"publishedDate":81,"cvssScore":44,"cvssVersion":45,"severity":46,"isKev":17,"epssScore":82},"CVE-2021-45733","TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the parameter host_time.",{"cveId":87,"description":88,"publishedDate":81,"cvssScore":89,"cvssVersion":45,"severity":63,"isKev":17,"epssScore":90},"CVE-2021-45735","TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept user credentials via packet capture software.",7.5,0.03798,[],{"title":93,"metaDescription":94,"keywords":95,"structuredData":96},"X5000r Firmware by Totolink - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for X5000r Firmware by Totolink covering 6 versions with 63 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","X5000r Firmware vulnerabilities, X5000r Firmware security, X5000r Firmware CVE, Totolink X5000r Firmware, X5000r Firmware threat intelligence, Totolink security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":97,"@type":98,"name":99,"description":94,"url":100,"manufacturer":101,"applicationCategory":105,"softwareVersion":106,"mainEntity":107},"https:\u002F\u002Fschema.org","SoftwareApplication","X5000r Firmware","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Ftotolink\u002Fx5000r_firmware",{"@type":102,"name":103,"url":104},"Organization","Totolink","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Ftotolink","Security Software","6 versions tracked",{"@type":108,"name":109,"description":110,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","X5000r Firmware Security Vulnerabilities","Security vulnerabilities affecting X5000r Firmware by Totolink",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":112,"apiVersion":113},"2026-10-18T14:18:15.512Z","3.0",{"rows":115,"total":11,"capped":17,"failed":11},[],[]]