CVE-2022-26213: Totolink x5000r Firmware

Critical severity, CVSS 9.8. EPSS: 25.6% chance of exploitation in the next 30 days.

Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected products

• Totolink x5000r Firmware: version 9.1.0u.6118_b20201102 only

Published 2022-03-15. Last modified 2026-06-17.