CVE-2025-14586 is a medium severity OS command injection flaw (CVSS 6.3) in the TOTOLINK X5000R router, firmware 9.1.0cu.2089_B20211224. The record says the exploit is public and gives no fixed firmware. Look for newer firmware and keep the admin interface off the internet.
What's affected
The record lists the TOTOLINK X5000R and its firmware product, build 9.1.0cu.2089_B20211224. The reported location is the cstecgi.cgi script, action exportOvpn, and the User argument. The record names the snprintf function as where the manipulation lands.
The record does not name a fixed firmware version. Check the TOTOLINK download page and support channel for newer firmware for the X5000R.
The score is 6.3 (medium). The vector needs a low privilege login, which limits exposure compared with an open interface, but a router admin page reachable from the internet is still a poor place to depend on that.
How to check if you're exposed
Open the router admin page and read the firmware version on the status or system page. If it reads 9.1.0cu.2089_B20211224, you match the record. Then check whether the admin page is reachable from outside your network.
From a machine outside your network, test the public address of the router on the ports it uses for management. If you see a login page, the interface is exposed and you should close it at once.
If you manage many routers, record model and firmware per device in a spreadsheet, since there is no package manager to ask.
What to do now
- Record the firmware version of each X5000R you run.
- Check the TOTOLINK site for newer firmware and apply it if the release notes cover this issue.
- Turn off remote administration, and allow the admin page only from the local network.
- Change the admin password to a long unique one and remove accounts you do not use.
- If no update appears, plan to replace the device where it protects anything important.
Why it matters
Command injection happens when input reaches a shell command without being kept apart from it. The weaknesses are CWE-77 (command injection), CWE-78 (OS command injection). On a router the stakes are higher than on a normal web app, since the device sits between your network and the internet and often runs with full rights.
The CVE is not on the CISA Known Exploited Vulnerabilities list, although the record says the exploit is public. Consumer and small office routers rarely get timely firmware, so network design and access limits matter more than waiting for a patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why not just wait for firmware?
There may be none. Turning off remote administration and limiting the admin page to the local network lowers exposure now and does not depend on the vendor.
Does this CVE appear in the CISA KEV list?
No. The record marks it as not in the Known Exploited Vulnerabilities catalog. It does say a public exploit exists, so treat it as a real risk anyway.
Sources
- Safeguard Gold entry for CVE-2025-14586
- github.com reference
- vuldb.com reference
- vuldb.com reference
- vuldb.com reference
This post is based on the CVE record (published 2025-12-13, source cna@vuldb.com). The reference pages above are the ones the record lists. Check them for any later changes.
Last reviewed: 19 October 2026.
