Remote Command Injection in TOTOLINK X5000R

The TOTOLINK X5000R router, specifically version 9.1.0cu.2089_B20211224, is susceptible to an OS command injection vulnerability (CVE-2026-91853). The vulnerability resides within the exportOvpn handler, which is invoked via the /cgi-bin/cstecgi.cgi script. An attacker can trigger this flaw by manipulating the filetype argument during an export request. Because the application fails to properly sanitize user-supplied input before passing it to the underlying system shell, an unauthenticated remote attacker can achieve arbitrary code execution. This vulnerability is publicly disclosed, increasing the risk of exploitation by opportunistic actors targeting edge network infrastructure. Defenders should monitor web server logs for suspicious requests directed at the exportOvpn handler.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands on the affected router. This could result in full device compromise, unauthorized access to internal network traffic, and the use of the router as a pivot point for further lateral movement within the environment.

Recommendation

• Monitor web server traffic for HTTP requests targeting /cgi-bin/cstecgi.cgi with suspicious parameters in the filetype argument.
• Implement access control lists on edge firewalls to restrict access to the web management interface of affected TOTOLINK routers to trusted IP ranges only.
• Audit network logs for anomalous outbound connections originating from router infrastructure.