Is CVE-2026-91853 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91853 being exploited in the wild.

How severe is CVE-2026-91853?

High severity, with a CVSS score of 7.4, published 15 September 2026.

Which products and versions are affected?

TOTOLINK X5000r 9.1.0cu.2089_B20211224.

Is there a fix for CVE-2026-91853?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-91853 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-91853?

Check whether you run TOTOLINK X5000r at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91853: TOTOLINK X5000R OS command injection in exportOvpn handler

CVE-2026-91853 · Severity: high · CVSS 7.4 · Published 2026-09-15

TOTOLINK X5000R is a wireless router used to provide network connectivity in homes and small offices. The device's firmware contains a command injection vulnerability in its VPN export feature that allows a remote attacker to execute arbitrary commands on the router without authentication, potentially compromising network security and customer data.

Technologies: TOTOLINK X5000r. Vendors: TOTOLINK.

Quick answers

Is CVE-2026-91853 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91853 being exploited in the wild.
How severe is CVE-2026-91853?: High severity, with a CVSS score of 7.4, published 15 September 2026.
Which products and versions are affected?: TOTOLINK X5000r 9.1.0cu.2089_B20211224.
Is there a fix for CVE-2026-91853?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91853 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-91853?: Check whether you run TOTOLINK X5000r at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the exportOvpn handler of the cstecgi.cgi component in TOTOLINK X5000R firmware v9.1.0cu.2089_B20211224. The vulnerability occurs because user-supplied input from the filetype parameter is extracted and directly concatenated into a shell command executed via system() without validation or shell escaping. When a remote attacker sends a crafted request with shell metacharacters (e.g., semicolons) in the filetype parameter, the injected characters escape the intended command argument and allow execution of arbitrary OS commands. The attack requires only network reachability to the device's web interface and no authentication. An attacker can exploit this to achieve remote code execution with the privileges of the cstecgi.cgi process.

Affected products

TOTOLINK X5000R 9.1.0cu.2089_B20211224

Timeline

2026-09-15: disclosed: Vulnerability disclosed publicly on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.