CVE-2025-9934: TOTOLINK X5000R cstecgi.cgi sub_410C34 command injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-04 · updated 2026-06-17
Weakness: CWE-74

Description

A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument pid results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Affected products

TOTOLINK X5000R: 9.1.0cu.2415_b20250515

References

https://github.com/Axelioc/CVE/blob/main/TOTOLINK/X5000R/sub_410C34/sub_410C34.md
https://github.com/Axelioc/CVE/blob/main/TOTOLINK/X5000R/sub_410C34/sub_410C34.md#poc
https://vuldb.com/?ctiid.322336
https://vuldb.com/?id.322336
https://vuldb.com/?submit.643048
https://www.totolink.net/

Get alerted when CVE-2025-9934 or the next vulnerability affects your stack