# CVE-2026-91853: TOTOLINK X5000R OS command injection in exportOvpn handler

Source: https://junglewise.ai/threats/cve-2026-91853-totolink-x5000r-os-command-injection-in-exportovpn-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91853 · Severity: high · CVSS 7.4 · Published 2026-09-15

TOTOLINK X5000R is a wireless router used to provide network connectivity in homes and small offices. The device's firmware contains a command injection vulnerability in its VPN export feature that allows a remote attacker to execute arbitrary commands on the router without authentication, potentially compromising network security and customer data.

Technologies: [TOTOLINK X5000r](https://junglewise.ai/threats/technologies/x5000r). Vendors: [TOTOLINK](https://junglewise.ai/threats/vendors/totolink).

## Quick answers

**Is CVE-2026-91853 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91853 being exploited in the wild.

**How severe is CVE-2026-91853?** High severity, with a CVSS score of 7.4, published 15 September 2026.

**Which products and versions are affected?** TOTOLINK X5000r 9.1.0cu.2089_B20211224.

**Is there a fix for CVE-2026-91853?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-91853 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-91853?** Check whether you run TOTOLINK X5000r at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the exportOvpn handler of the cstecgi.cgi component in TOTOLINK X5000R firmware v9.1.0cu.2089_B20211224. The vulnerability occurs because user-supplied input from the filetype parameter is extracted and directly concatenated into a shell command executed via system() without validation or shell escaping. When a remote attacker sends a crafted request with shell metacharacters (e.g., semicolons) in the filetype parameter, the injected characters escape the intended command argument and allow execution of arbitrary OS commands. The attack requires only network reachability to the device's web interface and no authentication. An attacker can exploit this to achieve remote code execution with the privileges of the cstecgi.cgi process.

## Affected products

- TOTOLINK X5000R 9.1.0cu.2089_B20211224

## Timeline

- 2026-09-15: disclosed: Vulnerability disclosed publicly on GitHub

## References

- [https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/2.md](https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/2.md)
- [https://vuldb.com/cve/CVE-2026-91853](https://vuldb.com/cve/CVE-2026-91853)

## Related threats

- [TOTOLINK X5000R hardcoded root password](https://junglewise.ai/threats/cve-2026-37152-totolink-x5000r-hardcoded-root-password)
- [TOTOLINK X5000R path traversal in OpenVPN Export](https://junglewise.ai/threats/cve-2026-15204-totolink-x5000r-path-traversal-in-openvpn-export)
- [TOTOLINK X5000R denial of service in cstecgi.cgi](https://junglewise.ai/threats/cve-2025-67445-totolink-x5000r-denial-of-service-in-cstecgi-cgi)
- [A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function…](https://junglewise.ai/threats/cve-2025-14586-a-vulnerability-was-determined-in-totolink-x5000r-9-1-0cu-2089)
- [Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank…](https://junglewise.ai/threats/cve-2025-13184-unauthenticated-telnet-enablement-via-cstecgi-cgi-auth-bypass)