CVE-2025-14586

A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user. This manipulation of the argument User causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

• CWE-77
• CWE-78
• CWE-78

• https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/1.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.336206Permissions Required, VDB Entry
• https://vuldb.com/?id.336206Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.705593Third Party Advisory, VDB Entry
• https://www.totolink.net/Product

Published

Dec 13, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14580A security vulnerability has been detected in Qualitor up to…6.1
• CVE-2025-14581The HAPPY – Helpdesk Support Ticket System plugin for WordPr…4.3
• CVE-2025-14582A vulnerability was detected in campcodes Online Student Enr…7.2
• CVE-2025-14583A flaw has been found in campcodes Online Student Enrollment…9.8
• CVE-2025-14584A vulnerability has been found in itsourcecode COVID Trackin…9.8
• CVE-2025-14585A vulnerability was found in itsourcecode COVID Tracking Sys…9.8
• CVE-2025-14587A vulnerability was identified in itsourcecode Online Pet Sh…9.8
• CVE-2025-14588A security flaw has been discovered in itsourcecode Student …9.8
• CVE-2025-14589A weakness has been identified in code-projects Prison Manag…8.8
• CVE-2025-1459The Page Builder by SiteOrigin plugin for WordPress is vulne…5.4
• CVE-2025-14590A security vulnerability has been detected in code-projects …9.8
• CVE-2025-14591In Delphix Continuous Compliance version 2025.3.0 and later,…7.5