Unrated severityNVD Advisory· Published Jun 3, 2025· Updated Jun 3, 2025
TOTOLINK X2000R formWsc command injection
CVE-2025-5504
Description
A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWsc. The manipulation of the argument peerRptPin leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
2- TOTOLINK/X2000Rv5Range: 1.0.0-B20230726.1108
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- github.com/fizz-is-on-the-way/Iot_vuls/blob/main/X2000R/RCE_formWsc/RCE_formWsc.mdmitreexploit
- vuldb.commitrethird-party-advisory
- vuldb.commitresignaturepermissions-required
- vuldb.commitrevdb-entrytechnical-description
- www.totolink.netmitreproduct
News mentions
1- RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning ExploitsTrend Micro Research · Oct 9, 2025