Quick answers
- Is CVE-2025-67445 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-67445 being exploited in the wild.
- How severe is CVE-2025-67445?
- High severity, with a CVSS score of 7.5, published 24 February 2026.
- Which products and versions are affected?
- TOTOLINK X5000r Firmware 9.1.0cu.2415_B20250515.
- Is there a fix for CVE-2025-67445?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-67445 attacked?
- It is attacked over the network or from the adjacent network, in a network appliance.
- Am I affected by CVE-2025-67445?
- Check whether you run TOTOLINK X5000r or TOTOLINK X5000r Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists within the /cgi-bin/cstecgi.cgi component of the TOTOLINK X5000R router. The CGI handler reads the CONTENT_LENGTH environment variable from an incoming HTTP POST request and uses it to perform a memory allocation via malloc(CONTENT_LENGTH + 1) without adequate bounds checking. Because the underlying lighttpd web server configuration has the 'server.max-request-size' limit commented out, an unauthenticated attacker can provide an arbitrarily large CONTENT_LENGTH. On devices with limited physical RAM (e.g., 256MB), this leads to memory exhaustion or a segmentation fault, resulting in a crash of the management CGI and a denial-of-service for the web interface.
Affected products
- TOTOLINK X5000R firmware 9.1.0cu.2415_B20250515
Timeline
- 2026-02-24: disclosed
- 2026-02-24: advisory