High severity7.4NVD Advisory· Published Sep 15, 2026· Updated Sep 15, 2026

CVE-2026-91853

Description

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Totolink/TOTOLINK_X5000Rllm-create
Range: 9.1.0cu.2089_B20211224
Totolink/X5000Rllm-fuzzy
Range: 9.1.0cu.2089_B20211224

Patches

Vulnerability mechanics

References

github.com/awigwu76/TOTOLINK_X5000R/blob/main/2.mdnvd
vuldb.com/cve/CVE-2026-91853nvd
vuldb.com/submit/933810nvd
vuldb.com/vuln/404082nvd
vuldb.com/vuln/404082/ctinvd
www.totolink.netnvd

News mentions

No linked articles in our index yet.

cvss	0.481
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000