ID
VAR-202509-0181
CVE
CVE-2025-9934
TITLE
TOTOLINK of X5000R Injection Vulnerability in Firmware
Trust: 0.8
DESCRIPTION
A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument pid results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. TOTOLINK of X5000R The firmware contains injection and command injection vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The TOTOLINK X5000R is a wireless router that supports Wi-Fi 6 technology, featuring a full-coverage mesh system and dual-band transmission capabilities, making it suitable for home and enterprise network environments. The TOTOLINK X5000R has a command injection vulnerability caused by the failure of the pid parameter in the /cgi-bin/cstecgi.cgi file to properly sanitize special characters and commands when constructing commands. Detailed vulnerability details are not available at this time
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | totolink | model: | x5000r | scope: | eq | version: | 9.1.0cu.2415_b20250515 | Trust: 1.0 |
| vendor: | totolink | model: | x5000r | scope: | eq | version: | x5000r firmware 9.1.0cu.2415 b20250515 | Trust: 0.8 |
| vendor: | totolink | model: | x5000r | scope: | - | version: | - | Trust: 0.8 |
| vendor: | totolink | model: | x5000r | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | totolink | model: | x5000r 9.1.0cu.2415 b20250515 | scope: | - | version: | - | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-74 | Trust: 1.0 |
| problemtype: | CWE-77 | Trust: 1.0 |
| problemtype: | injection (CWE-74) [ others ] | Trust: 0.8 |
| problemtype: | Command injection (CWE-77) [NVD evaluation ] | Trust: 0.8 |
| problemtype: | Command injection (CWE-77) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-9934 | Trust: 3.2 |
| db: | VULDB | id: | 322336 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2025-014904 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-20930 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/axelioc/cve/blob/main/totolink/x5000r/sub_410c34/sub_410c34.md | Trust: 2.4 |
| url: | https://github.com/axelioc/cve/blob/main/totolink/x5000r/sub_410c34/sub_410c34.md#poc | Trust: 1.8 |
| url: | https://vuldb.com/?id.322336 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.643048 | Trust: 1.8 |
| url: | https://www.totolink.net/ | Trust: 1.8 |
| url: | https://vuldb.com/?ctiid.322336 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-9934 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2025-20930 |
| db: | JVNDB | id: | JVNDB-2025-014904 |
| db: | NVD | id: | CVE-2025-9934 |
LAST UPDATE DATE
2025-10-03T23:36:00.249000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-20930 | date: | 2025-09-10T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-014904 | date: | 2025-10-02T03:19:00 |
| db: | NVD | id: | CVE-2025-9934 | date: | 2025-09-29T18:34:55.073 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-20930 | date: | 2025-09-10T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-014904 | date: | 2025-10-02T00:00:00 |
| db: | NVD | id: | CVE-2025-9934 | date: | 2025-09-04T10:42:37.390 |