CVE-2025-9934 is a medium severity (6.3, CVSS 3.1) command injection in TOTOLINK X5000R firmware 9.1.0cu.2415_B20250515, in the web service at /cgi-bin/cstecgi.cgi. No fixed firmware is confirmed in the sources we could read, so limit access to the admin interface and check TOTOLINK's site.
What's affected
The record lists the TOTOLINK X5000R and its firmware, version 9.1.0cu.2415_B20250515. The record describes the function sub_410C34 in /cgi-bin/cstecgi.cgi and says manipulating the pid argument results in command injection. It says remote exploitation is possible. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, a low privilege account needed, and limited impact on each of confidentiality, integrity and availability.
The researcher write-up linked from the record could not be loaded (the page returned not found), and the VulDB page would not load either, so this post rests on the record alone. Treat details here as the record states them.
Fixed versions: none confirmed. The record links no TOTOLINK advisory and names no patched build. Check the TOTOLINK download page for your exact model and hardware revision.
The record says the exploit has been made public. It is not in the CISA Known Exploited Vulnerabilities catalog, and nothing we read reports exploitation in the wild.
How to check if you're exposed
Open the router's admin page and read the firmware version on the status or upgrade screen. A X5000R on 9.1.0cu.2415_B20250515 is in scope.
Next, find out whether the admin web service is reachable from outside your network. From a device that is not on your LAN, try to load the router's public address on its admin port. If the login page loads, remote management is enabled and the risk is real.
If you run many routers, ask your device inventory for every X5000R and note the firmware build on each.
What to do now
- Disable remote web management and any port forward that points at the router's admin service.
- Put the router's admin interface on a management network that only trusted machines can reach.
- Check TOTOLINK's download page for firmware newer than 9.1.0cu.2415_B20250515. If you find one, read its notes and install it.
- If the model is end of life or has no newer firmware, plan to replace it.
- Watch for unexpected configuration changes, new accounts, or outbound connections from the router.
Why it matters
The weakness classes are CWE-74 (injection) and CWE-77 (command injection). In router firmware, a web handler that passes request data into a system command can let a remote user run commands on the device. The impact depends on how the handler runs, and on this class of device it usually means the router itself is compromised.
Small routers sit at the edge of a network and rarely get patched on a schedule. A public write-up shortens the time between disclosure and scanning, so removing remote access is the step that works today.
Quick check
Is there a fix for the TOTOLINK X5000R?
We could not confirm one. The record and the pages we could read name no patched firmware, so check TOTOLINK's support page for your exact hardware revision.
Can I rely on turning off remote management?
It removes the internet facing path, which is the most likely route. Anyone already on your local network could still reach the admin service, so keep untrusted devices off it.
Sources
- VulDB entry listed in the record (the page would not load for us, so nothing here relies on it)
- Gold vulnerability page
- Free in-browser dependency scan
Last reviewed: 18 October 2026.
