X5000r Firmware

Source repositories

https://github.com/awigwu76/TOTOLINK_X5000R

CVEs (70)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2021-27708	Totolink X5000R	Cri	0.64	9.8	0.08	Apr 14, 2021	Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes…
CVE-2024-34921	Totolink X5000R	Hig	0.58	8.8	0.09	May 14, 2024	TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.
CVE-2024-57022	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg.
CVE-2024-57021	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFiScheduleCfg.
CVE-2024-57020	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg.
CVE-2024-57019	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg.
CVE-2024-57018	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg.
CVE-2024-57017	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg.
CVE-2024-57016	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg.
CVE-2024-57015	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg.
CVE-2024-57014	Totolink X5000R	Hig	0.57	8.8	0.01	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.
CVE-2024-57013	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg.
CVE-2024-57012	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.
CVE-2024-57011	Totolink X5000R	Hig	0.57	8.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg.
CVE-2024-42739	Totolink X5000R	Hig	0.57	8.8	0.02	Aug 13, 2024	In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42738	Totolink X5000R	Hig	0.57	8.8	0.02	Aug 13, 2024	In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42737	Totolink X5000R	Hig	0.57	8.8	0.02	Aug 13, 2024	In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42748	Totolink X5000R	Hig	0.57	8.8	0.02	Aug 12, 2024	In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42747	Totolink X5000R	Hig	0.57	8.8	0.01	Aug 12, 2024	In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42745	Totolink X5000R	Hig	0.57	8.8	0.02	Aug 12, 2024	In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.

CVE-2021-27708CriApr 14, 2021
Totolink
X5000R
risk 0.64cvss 9.8epss 0.08
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes…
CVE-2024-34921HigMay 14, 2024
Totolink
X5000R
risk 0.58cvss 8.8epss 0.09
TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.
CVE-2024-57022HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg.
CVE-2024-57021HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFiScheduleCfg.
CVE-2024-57020HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg.
CVE-2024-57019HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg.
CVE-2024-57018HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg.
CVE-2024-57017HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg.
CVE-2024-57016HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg.
CVE-2024-57015HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg.
CVE-2024-57014HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.01
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.
CVE-2024-57013HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg.
CVE-2024-57012HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.
CVE-2024-57011HigJan 15, 2025
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg.
CVE-2024-42739HigAug 13, 2024
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42738HigAug 13, 2024
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42737HigAug 13, 2024
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42748HigAug 12, 2024
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42747HigAug 12, 2024
Totolink
X5000R
risk 0.57cvss 8.8epss 0.01
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42745HigAug 12, 2024
Totolink
X5000R
risk 0.57cvss 8.8epss 0.02
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.

Page 2 of 4