CVE-2025-70327 is an argument injection flaw in TOTOLINK X5000R firmware v9.1.0cu_2415_B20250515, scored 9.8 critical. The setDiagnosisCfg handler passes the ip value to ping without rejecting a leading hyphen. The record names no fixed version, so check the vendor site and restrict admin access.
What's affected
The record lists the TOTOLINK X5000R and its firmware, with version 9.1.0cu_2415_B20250515 named in the description. No fixed version is given.
How to check if you're exposed
- Sign in to the router admin page and read the firmware version. Compare it with 9.1.0cu_2415_B20250515.
- Check the TOTOLINK support site for newer X5000R firmware and any security note.
- Confirm whether the admin interface is reachable from the internet.
What to do now
- Find every X5000R in use and record its firmware version.
- Look for newer firmware from the vendor. The record does not name a fix.
- Disable remote administration and limit the web interface to a trusted management network.
- Use a strong, unique admin password. The description says the attacker is authenticated, even though the CVSS vector lists no privileges required, so credential hygiene still matters.
- Replace the device if the vendor does not ship a fix.
Why it matters
The handler reads a request value and builds a ping command from it. Because it does not check whether the value starts with a hyphen, the input can be read by ping as an option instead of an address. That is CWE-88 (argument injection). The record also tags CWE-400 (uncontrolled resource consumption), and the stated impact is denial of service through heavy resource use or a long running command.
The usual fix is to validate the address strictly and to pass an end of options marker before user data. The NVD score of 9.8 looks high next to a denial of service description, so read the vector and the text together when you rank this one.
Quick check
Does this bug give remote code execution?
The description only claims potential denial of service through injected ping options. The 9.8 score comes from the vector, not from a code execution claim.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Referenced by the CVE record (not independently fetched for this guide):
Last reviewed: 19 October 2026.
