Totolink X5000R EUVD-2026-28528

Requires valid authentication to the Totolink X5000R web management interface (CVSS PR:L - low-privileged user account). Attackers must first compromise router credentials through default passwords (if unchanged from factory settings like admin/admin), credential reuse, phishing of network administrators, or prior network breach. Router's web management interface must be network-accessible to the attacker - either exposed to the internet (common misconfiguration) or reachable from attacker's position in internal network. Vulnerability exists specifically when accessing the DDNS configuration functionality at /boafrm/formDdns endpoint. No user interaction required (UI:N) once authenticated. Exploitation limited to Totolink X5000R firmware version 9.1.0u.6369_B20230113; other versions not confirmed vulnerable. Default configurations with unchanged credentials present highest risk; routers with strong authentication and restricted management access significantly reduce practical exploitability despite network attack vector.

Real-world risk is moderate-high with important caveats. CVSS 7.4 (High) reflects network-accessible exploitation (AV:N) with low complexity (AC:L) but requires low-privilege authentication (PR:L), meaning attackers need valid router credentials. The CVSS E:P metric confirms proof-of-concept exploit exists publicly on GitHub, significantly lowering the skill threshold for exploitation. However, exploitation conditions limit widespread automated attacks: attackers must first obtain router admin/user credentials through phishing, credential stuffing, default password exploitation, or lateral movement from compromised networks. No CISA KEV listing suggests this is not being exploited at scale in the wild, likely because the authentication barrier prevents mass exploitation. EPSS score unavailable but likely low-to-moderate given the credential requirement. Priority is HIGH for internet-facing routers with weak/default credentials or in environments where credential compromise is realistic. Priority is MEDIUM for properly secured internal routers with strong authentication. The lack of vendor patch information (Totolink has not issued advisory per available references) elevates risk as remediation options are limited.

An attacker on the internet identifies a Totolink X5000R router with exposed web management interface (common on port 80/443). They obtain valid credentials through credential stuffing using default passwords (admin/admin) or leaked password databases. Authenticated to the router's web interface, the attacker navigates to the DDNS configuration page (/boafrm/formDdns) and submits a malicious HTTP POST request with an oversized submit-url parameter (e.g., 2000+ byte string containing shellcode). The buffer overflow in sub_458E40 overwrites return addresses on the stack, redirecting execution to attacker-controlled shellcode that establishes a reverse shell with root privileges on the router's embedded Linux OS. From this foothold, the attacker pivots to internal network reconnaissance, intercepts traffic, or uses the router as a persistent command-and-control relay. Public POC code on GitHub (https://github.com/Kiciot/cve/issues/4) provides technical implementation details, lowering exploitation barrier.