Totolink x5000r vulnerabilities

3 CVEs affecting Totolink x5000r, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-91853, published 2026-09-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-91853, published 2026-09-15. High severity, CVSS 7.4. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component…
CVE-2026-8137, published 2026-05-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability has been found in Totolink X5000R 9.1.0u.6369_B20230113. This vulnerability affects the function sub_458E40 of the file /boafrm/formDdns. The manipulation of the argument submit-url…
CVE-2026-15204, published 2026-07-09. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin/cstecgi.cgi of the…