CVE-2025-5504

CWE-74CWE-77 — Command Injection5 documents5 sources
Severity
5.3MEDIUM
EPSS
4.4%
top 11.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink X2000rTotolink X2000r Firmware
Timeline
PublishedJun 3
Latest updateDec 3

Description

A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWsc. The manipulation of the argument peerRptPin leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/x2000r1.0.0-B20230726.1108
▶NVDtotolink/x2000r_firmware1.0.0-b20230726.1108

🔴Vulnerability Details

3
CVEList
TOTOLINK X2000R formWsc command injection↗2025-06-03
▶
GHSA
GHSA-j9x6-j7hr-4vpf: A vulnerability has been found in TOTOLINK X2000R 1↗2025-06-03
▶
VulnCheck
totolink x2000r_firmware Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')↗2025
▶

💥Exploits & PoCs

1
Exploit-DB
phpMyAdmin 5.0.0 - SQL Injection↗2025-12-03
▶
CVE-2025-5504 (MEDIUM CVSS 5.3) | A vulnerability has been found in T | cvebase.io