What is the CVSS score of CVE-2025-67445?

CVE-2025-67445 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of X5000r Firmware are affected by CVE-2025-67445?

A high-severity vulnerability in X5000R firmware allows attackers to exhaust system resources, potentially causing service disruptions.

Is there a public PoC exploit available for CVE-2025-67445?

Yes, a public proof-of-concept exploit is available for CVE-2025-67445. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-67445?

Within 24 hours: Identify all X5000R devices running firmware versions up to 9.1.0cu.2415_b20250515 and assess network exposure. Within 7 days: Implement network segmentation to restrict access to affected devices and enable resource monitoring/alerting. Within 30 days: Maintain vendor contact for patch ETA; evaluate firmware upgrade paths or device replacement if patch remains unavailable.

X5000r Firmware CVE-2025-67445

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-02-24 cve@mitre.org

Denial Of Service X5000r Firmware TOTOLINK

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 27, 2026 - 19:16 vuln.today

Public exploit code

CVE Published

Feb 24, 2026 - 15:21 nvd

HIGH 7.5

DescriptionNVD

TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment variable and allocates memory using malloc (CONTENT_LENGTH + 1) without sufficient bounds checking. When lighttpd s request size limit is not enforced, a crafted large POST request can cause memory exhaustion or a segmentation fault, leading to a crash of the management CGI and loss of availability of the web interface.

AnalysisAI

X5000R Firmware versions up to 9.1.0cu.2415_b20250515 is affected by uncontrolled resource consumption (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-400: Uncontrolled Resource Consumption) affects X5000R Firmware. TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment variable and allocates memory using malloc (CONTENT_LENGTH + 1) without sufficient bounds checking. When lighttpd s request size limit is not enforced, a crafted large POST request can cause memory exhaustion or a segmentation fault, leading to a crash of the management CGI and loss of availability of the web interface.