Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-91853

TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection

CVSS 4.0 5.3 MEDIUMCVSS 3.1 7.4 HIGHCVSS 3.0 7.4 HIGHCVSS 2.0 6.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-91853

Published

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-91853

Published

X5000R

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "TOTOLINK",
                    "product": "X5000R",
                    "versions": [
                        {
                            "version": "9.1.0cu.2089_B20211224",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:o:totolink:x5000r_firmware:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Export Ovpn Handler"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON