TOTOLINK X5000R CVE-2026-37152

Requires network reachability to a TOTOLINK X5000R (firmware V9.1.0cu.2415_B20250515) authentication service that accepts the hardcoded root credential - typically the Telnet, SSH, or web management interface. No prior authentication, user interaction, or special configuration is needed once that service is reachable, so exploitation is trivial against affected units. The primary LIMITING factor is exposure of the management interface: on default SOHO deployments it is usually bound to the LAN, so unauthenticated remote exploitation from the internet requires the device to have its admin/remote-management service exposed to the WAN.

The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is directionally plausible for a hardcoded root credential (CWE-798) on a SOHO router: any actor who reaches an authentication service on the device can log in as root and fully compromise it, yielding complete confidentiality, integrity, and availability loss. However, the network vector (AV:N) implicitly assumes the root-authenticated service (typically Telnet, SSH, or the web admin) is reachable by the attacker; on most home/SOHO deployments that service is LAN-facing rather than WAN-facing, so realistic exposure is often adjacent-network unless the device is directly internet-exposed - verify management-interface exposure per deployment. Exploitation signals are mixed: publicly available exploit/PoC material exists (a dedicated GitHub repository documenting the hardcoded password), which lowers the barrier to abuse, yet EPSS is only 0.19% (9th percentile) and the CVE is NOT in CISA KEV, indicating no confirmed widespread or active exploitation at this time. Net assessment: a genuinely high-impact, low-skill flaw once the device is reachable, but current real-world exploitation is unproven and the true attack surface hinges on whether root login is exposed beyond the LAN. Note also that the input metadata is low quality - the CPE is a placeholder ('n/a'), the vendor/product tags are junk ('N A'), and no affected-version data beyond the single firmware build is structured - so automated correlation should not be trusted here.

An attacker who can reach the router's management service (Telnet/SSH/web admin) - either on the local network or on a device with the interface exposed to the WAN - authenticates using the known hardcoded root credential and obtains a full root shell. Because the password is fixed in firmware, no brute force or prior access is needed, and a public GitHub repository already documents the credential, making exploitation trivial for anyone who can reach the device.