Deviceways

Router

TOTOLINK X5000R

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
Hardware revision not specified
Get OpenWrt firmware Release listed · 25.12.6
V1
Open hardware record
Hardware revision not specified
Open hardware record Release listed · 25.12.5
Original project github.com

Recorded configuration: 16 MB flash; 256 MB RAM

First installation
GUI OEM
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

TOTOLINK X5000R — TechInfoDepot (github.com)

Hardware revision
V1

OpenWrt

OpenWrt — Source documentation (openwrt.org)

Installation routes recorded
GUI OEM
Availability recorded by source
Available 2021

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 9.8 (v3.1)

TOTOLINK X5000R

TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.

CVE-2026-37152

Affected firmware
X5000R: V9.1.0cu.2415_B20250515 was discovered to
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.

CVE published

CVSS 9.8 (v3.1)

TOTOLINK X5000R

TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable

CVE-2025-70327

Affected firmware
X5000R: v9.1.0cu_2415_B20250515
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The ip parameter is retrieved via websGetVar and passed to a ping command through CsteSystem without validating if the input starts with a hyphen (-). This allows remote authenticated attackers to inject arbitrary command-line options into the ping utility, potentially leading to a Denial of Service (DoS) by causing excessive resource consumption or prolonged execution.

CVE published

CVSS 9.8 (v3.1)

TOTOLINK X5000R

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist

CVE-2024-42737

Affected firmware
X5000r: v9.1.0cu.2350_b20230313
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.

CVE published

CVSS 9.8 (v3.1)

TOTOLINK X5000R

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg

CVE-2024-42748

Affected firmware
X5000r: v9.1.0cu.2350_b20230313
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.

CVE published

CVSS 9.8 (v3.1)

TOTOLINK X5000R

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg

CVE-2024-42745

Affected firmware
X5000r: v9.1.0cu.2350_b20230313
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.

Check more security advisories for this device · CVE.org