Executive brief
TOTOLINK X5000R is a wireless router used to provide network connectivity in homes and small offices. The device's firmware contains a command injection vulnerability in its VPN export feature that allows a remote attacker to execute arbitrary commands on the router without authentication, potentially compromising network security and customer data.
Technical details
A command injection vulnerability exists in the exportOvpn handler of the cstecgi.cgi component in TOTOLINK X5000R firmware v9.1.0cu.2089_B20211224. The vulnerability occurs because user-supplied input from the filetype parameter is extracted and directly concatenated into a shell command executed via system() without validation or shell escaping. When a remote attacker sends a crafted request with shell metacharacters (e.g., semicolons) in the filetype parameter, the injected characters escape the intended command argument and allow execution of arbitrary OS commands. The attack requires only network reachability to the device's web interface and no authentication. An attacker can exploit this to achieve remote code execution with the privileges of the cstecgi.cgi process.
Affected products
- TOTOLINK X5000R 9.1.0cu.2089_B20211224
Timeline
- 2026-09-15: disclosed: Vulnerability disclosed publicly on GitHub