TOTOLINK X5000R CVE-2025-14586

Valid administrative credentials to the TOTOLINK X5000R web management interface are required to access the vulnerable cstecgi.cgi CGI script. The /cgi-bin/cstecgi.cgi endpoint must be reachable over the network (typically HTTPS port 443). The vulnerability specifically triggers when the exportOvpn action is called with a crafted User parameter containing command injection payloads. No special firmware configuration beyond the default installation is required; the CGI script is present in the baseline firmware. The limiting factor is the requirement for prior authentication (PR:L in CVSS vector), which prevents unauthenticated remote exploitation but does not mitigate the risk once an attacker obtains or guesses administrative credentials.

The CVSS vector shows AV:N (network-accessible), AC:L (low attack complexity), and PR:L (requires login), with low confidentiality, integrity, and availability impacts rated. However, this scoring is misleading because command injection fundamentally enables full system compromise regardless of the low-impact ratings assigned. The EPSS score of 1.71% at the 82nd percentile indicates this is a below-average exploitation probability relative to all CVEs, likely reflecting that the vulnerability requires prior authentication as a limiting factor. The critical signal is that public exploit code exists, confirmed by the referenced GitHub repository, combined with the low CVSS vector complexity suggesting the exploit is trivial to execute once credentials are obtained. The discrepancy between CVSS (2.1) and realistic impact (complete router compromise) suggests defenders should prioritize this higher than the CVSS score alone indicates, particularly in organizations where router admin credentials may be shared or weak. The authentication requirement (PR:L) is the primary mitigating factor preventing widespread automated exploitation of internet-facing devices.

An attacker with valid administrative credentials to the TOTOLINK X5000R web interface navigates to the VPN configuration export function (/cgi-bin/cstecgi.cgi?action=exportOvpn&type=user) and crafts a malicious User parameter containing shell metacharacters such as pipe symbols or semicolons to inject arbitrary OS commands. The crafted request is sent to the router, the vulnerable snprintf function fails to sanitize the input, and the injected command executes with the privileges of the web server process, potentially achieving system-level compromise including firmware modification or data exfiltration.