EUVD-2026-78811
GHSA-4m6v-x9gf-2c93
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Hardcoded root credential grants full device control with no auth (PR:N) via a network-facing management service (AV:N/AC:L), yielding total C/I/A loss; AV:N assumes the login service is network-reachable.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
6DescriptionCVE.org
TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.
AnalysisAI
Hardcoded root credentials in TOTOLINK X5000R firmware V9.1.0cu.2415_B20250515 allow unauthenticated remote attackers to gain full administrative control, leading to complete compromise of confidentiality, integrity, and availability. The issue requires network reachability to an authentication service (such as Telnet, SSH, or the web management interface) that accepts the static credential, which is a trivial condition once that service is exposed; however, on typical SOHO deployments the management interface is bound to the LAN, so internet-based exploitation necessitates WAN exposure of the admin service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to a TOTOLINK X5000R (firmware V9.1.0cu.2415_B20250515) authentication service that accepts the hardcoded root credential - typically the Telnet, SSH, or web management interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is directionally plausible for a hardcoded root credential (CWE-798) on a SOHO router: any actor who reaches an authentication service on the device can log in as root and fully compromise it, yielding complete confidentiality, integrity, and availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor patch or updated firmware version is referenced in the available intelligence; consult TOTOLINK's official support site for a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately restrict access to the TOTOLINK X5000R management interface (Telnet, SSH, web) to trusted internal networks only, disable WAN exposure of these services, and monitor for unauthorized access attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today