TOTOLINK X5000R CVE-2026-15204

Q: What is the CVSS score of CVE-2026-15204?

CVE-2026-15204 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-42660 MEDIUM

Path Traversal (CWE-22)

2026-07-09 cna@vuldb.com

GHSA-c6wm-vgr9-6gqx

Path Traversal

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated read-only path traversal; no integrity or availability impact, unchanged scope, low confidentiality bounded to filesystem reads.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 18:48 vuln.today

DescriptionCVE.org

A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin/cstecgi.cgi of the component OpenVPN Export. The manipulation results in path traversal. The attack may be launched remotely.

AnalysisAI

Path traversal in the TOTOLINK X5000R router's OpenVPN Export CGI handler exposes arbitrary router filesystem files to remote unauthenticated attackers. The exportOvpn function within /web/cgi-bin/cstecgi.cgi fails to sanitize user-controlled path input, allowing directory traversal sequences to escape the intended export directory. A public proof-of-concept exists (GitHub: meishigana/CVE, referenced 2026-06-09), and the CVSS 4.0 supplemental metric E:P confirms exploit code is available, elevating practical risk beyond the moderate 5.5 base score.

Technical ContextAI

TOTOLINK X5000R is a SOHO Wi-Fi 6 router running an embedded Linux firmware. The web management interface is delivered through /web/cgi-bin/cstecgi.cgi, a monolithic CGI binary that dispatches requests to internal handler functions. The affected handler exportOvpn is responsible for generating and delivering OpenVPN client configuration bundles. CWE-22 (Path Traversal) indicates the function constructs a filesystem path using attacker-supplied input without adequate canonicalization or allowlisting, enabling sequences such as ../../ to traverse outside the intended export directory. Affected firmware versions are 9.1.0cu.2415_B20250515 and 9.1.0cu.2350_B20230313, identified via CPE-equivalent naming in the NVD submission. No server-side framework sanitization appears to intercept the malformed path before the file is read and returned to the caller.

RemediationAI

No vendor-released patch version is identified in the available data; TOTOLINK's website (https://www.totolink.net/) should be checked for updated firmware releases addressing CVE-2026-15204. As an immediate compensating control, disable WAN-side web management access on the X5000R to restrict exploitation to LAN-local attackers only - this is the highest-leverage mitigation given the router's typical deployment context. If OpenVPN client export functionality is not in active use, disabling or blocking access to the relevant CGI endpoint via firewall ACL on the management VLAN reduces the attack surface further. For organizations that have deployed this model at scale, network segmentation ensuring the management interface is reachable only from a dedicated management network limits the blast radius of any exploit attempt. Monitor VulDB entry https://vuldb.com/vuln/377125 and the TOTOLINK firmware download portal for patch availability.