PT-2026-21543 · Totolink · Totolink X5000R

Published 2025-10-22 · Updated 2026-02-28 · CVE-2025-70329

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLink X5000R version 9.1.0cu 2415 B20250515

Description The TOTOLink X5000R router firmware contains an OS command injection issue in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlanVidLan1 (and other vlanVidLanX) parameters, obtained using Uci Get Str, are passed to the CsteSystem function without sufficient validation. This allows an authenticated attacker to execute arbitrary shell commands with root privileges by injecting shell metacharacters into the affected parameters.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-02543

CVE-2025-70329

Affected Products

Totolink X5000R

References · 11

• 🔥 https://notion.so/TOTOLINK-X5000R-SetIptvCfg-2d170566ca7f8027ad47e6b5429025fc?source=copy_link · Exploit
• 🔥 https://github.com/neighborhood-H/0-DAY/blob/main/Toto-link/X5000R/SetIptvCfg/report.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-70329 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02543 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-70329 · Security Note
• https://twitter.com/TheHackerWire/status/2026031843246842340 · Twitter Post
• https://twitter.com/cracbot/status/2027700393506181505 · Twitter Post
• https://twitter.com/CVEnew/status/2026265055990358387 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026041212759679234 · Twitter Post
• https://twitter.com/cracbot/status/2027338093418946849 · Twitter Post
• https://notion.so/TOTOLINK-X5000R-SetIptvCfg-2d170566ca7f8027ad47e6b5429025fc · Note