CVE-2025-70327 — Argument Injection in X5000r Firmware

CWE-88 — Argument InjectionCWE-400 — Uncontrolled Resource Consumption3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
2.5%
top 14.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Totolink X5000r Firmware
Timeline
PublishedFeb 23

Description

TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The ip parameter is retrieved via websGetVar and passed to a ping command through CsteSystem without validating if the input starts with a hyphen (-). This allows remote authenticated attackers to inject arbitrary command-line options into the ping utility, potentially leading to a Denial of Service (DoS) by causing excessive resource consumpti…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDtotolink/x5000r_firmware9.1.0cu.2415_b20250515

🔴Vulnerability Details

2
GHSA
GHSA-p9m7-fwrr-649p: TOTOLINK X5000R v9↗2026-02-23
▶
CVEList
CVE-2025-70327: TOTOLINK X5000R v9↗2026-02-23
▶
CVE-2025-70327 — Argument Injection in X5000r Firmware | cvebase