Executive brief
A vulnerability in the TOTOLINK X5000R wireless router allows an attacker to crash the device's web management interface. By sending a specially crafted, oversized web request, an attacker can exhaust the router's memory, making it impossible for administrators to manage the device via its web portal. This results in a denial-of-service condition for the management functions of the router.
Technical details
The vulnerability exists within the /cgi-bin/cstecgi.cgi component of the TOTOLINK X5000R router. The CGI handler reads the CONTENT_LENGTH environment variable from an incoming HTTP POST request and uses it to perform a memory allocation via malloc(CONTENT_LENGTH + 1) without adequate bounds checking. Because the underlying lighttpd web server configuration has the 'server.max-request-size' limit commented out, an unauthenticated attacker can provide an arbitrarily large CONTENT_LENGTH. On devices with limited physical RAM (e.g., 256MB), this leads to memory exhaustion or a segmentation fault, resulting in a crash of the management CGI and a denial-of-service for the web interface.
Affected products
- TOTOLINK X5000R firmware 9.1.0cu.2415_B20250515
Timeline
- 2026-02-24: disclosed
- 2026-02-24: advisory