CVE-2025-70329

TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlanVidLan1 (and other vlanVidLanX) parameters are retrieved via Uci_Get_Str and passed to the CsteSystem function without adequate validation or filtering. This allows an authenticated attacker to execute arbitrary shell commands with root privileges by injecting shell metacharacters into the affected parameters.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/neighborhood-H/0-DAY/blob/main/Toto-link/X5000R/SetIptvCfg/report.md	Exploit Third Party Advisory
https://www.notion.so/TOTOLINK-X5000R-SetIptvCfg-2d170566ca7f8027ad47e6b5429025fc?source=copy_link	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:totolink:x5000r_firmware:9.1.0cu.2415_b20250515:*:*:*:*:*:*:*

cpe:2.3:h:totolink:x5000r:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-23 20:28

Updated : 2026-02-24 20:38

NVD link : CVE-2025-70329

Mitre link : CVE-2025-70329

CVE.ORG link : CVE-2025-70329

JSON object : View

Products Affected

totolink

x5000r
x5000r_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-70329", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2026-02-23T20:28:53.603", "references": [{"url": "https://github.com/neighborhood-H/0-DAY/blob/main/Toto-link/X5000R/SetIptvCfg/report.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.notion.so/TOTOLINK-X5000R-SetIptvCfg-2d170566ca7f8027ad47e6b5429025fc?source=copy_link", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlanVidLan1 (and other vlanVidLanX) parameters are retrieved via Uci_Get_Str and passed to the CsteSystem function without adequate validation or filtering. This allows an authenticated attacker to execute arbitrary shell commands with root privileges by injecting shell metacharacters into the affected parameters."}, {"lang": "es", "value": "TOTOLink X5000R v9.1.0cu_2415_B20250515 contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en el gestor setIptvCfg del ejecutable /usr/sbin/lighttpd. Los par\u00e1metros vlanVidLan1 (y otros vlanVidLanX) se recuperan a trav\u00e9s de Uci_Get_Str y se pasan a la funci\u00f3n CsteSystem sin validaci\u00f3n o filtrado adecuados. Esto permite a un atacante autenticado ejecutar comandos de shell arbitrarios con privilegios de root inyectando metacaracteres de shell en los par\u00e1metros afectados."}], "lastModified": "2026-02-24T20:38:09.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:totolink:x5000r_firmware:9.1.0cu.2415_b20250515:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B57DC2C-693C-459F-B7FD-900DF4A38A84"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:totolink:x5000r:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BC45BFB0-0CF0-4F9E-B19D-D274B17F1591"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}