ID
VAR-202506-0281
CVE
CVE-2025-5516
TITLE
TOTOLINK of x2000r Cross-site scripting vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20230726.1108. This affects an unknown part of the file /boafrm/formFilter of the component URL Filtering Page. The manipulation of the argument URL Address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. TOTOLINK of x2000r Firmware has a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. X2000R is a wireless router from China's TOTOLINK. X2000R 1.0.0-B20230726.1108 version of TOTOLINK (Shenzhen) Co., Ltd. has a cross-site scripting vulnerability. The vulnerability is caused by the lack of effective filtering and escaping of user-supplied data in the URL Address parameter. Attackers can exploit this vulnerability to execute arbitrary web scripts or HTML by injecting carefully designed payloads
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | totolink | model: | x2000r | scope: | eq | version: | 1.0.0-b20230726.1108 | Trust: 1.0 |
| vendor: | totolink | model: | x2000r | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | totolink | model: | x2000r | scope: | - | version: | - | Trust: 0.8 |
| vendor: | totolink | model: | x2000r | scope: | eq | version: | x2000r firmware 1.0.0-b20230726.1108 | Trust: 0.8 |
| vendor: | jiong | model: | x2000r 1.0.0-b20230726.1108 | scope: | - | version: | - | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-94 | Trust: 1.0 |
| problemtype: | CWE-79 | Trust: 1.0 |
| problemtype: | Cross-site scripting (CWE-79) [NVD evaluation ] | Trust: 0.8 |
| problemtype: | Cross-site scripting (CWE-79) [ others ] | Trust: 0.8 |
| problemtype: | Code injection (CWE-94) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-5516 | Trust: 3.2 |
| db: | VULDB | id: | 310953 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2025-006480 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-12342 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/fizz-is-on-the-way/iot_vuls/tree/main/x2000r/xss_url_filtering | Trust: 1.8 |
| url: | https://vuldb.com/?id.310953 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.584661 | Trust: 1.8 |
| url: | https://www.totolink.net/ | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-5516 | Trust: 1.4 |
| url: | https://vuldb.com/?ctiid.310953 | Trust: 1.0 |
SOURCES
| db: | CNVD | id: | CNVD-2025-12342 |
| db: | JVNDB | id: | JVNDB-2025-006480 |
| db: | NVD | id: | CVE-2025-5516 |
LAST UPDATE DATE
2025-06-14T22:51:57.098000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-12342 | date: | 2025-06-13T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-006480 | date: | 2025-06-09T05:01:00 |
| db: | NVD | id: | CVE-2025-5516 | date: | 2025-06-06T17:42:29.520 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-12342 | date: | 2025-06-12T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-006480 | date: | 2025-06-09T00:00:00 |
| db: | NVD | id: | CVE-2025-5516 | date: | 2025-06-03T18:15:27.067 |