Home / Vulnerability Intelligence / CVE-2025-70327

CVE-2025-70327 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: February 25, 2026

TOTOLINK X5000R - Command Injection

Published: February 23, 2026Updated: February 25, 2026Remote Exploitable

Overview

TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains a command injection caused by improper validation of the ip parameter in setDiagnosisCfg handler of /usr/sbin/lighttpd, letting remote authenticated attackers cause denial of service via injected ping options.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 204.9%(Probability of exploitation in next 30 days)

Impact

Remote authenticated attackers can cause denial of service by injecting options to the ping command, leading to resource exhaustion or prolonged execution.

Mitigation

Update to the latest version with proper input validation or patch from vendor.

References

Social Media Activity(1 post)

ZEN SecDB

@secdb

Mar 2, 2026

📈 CVE Published in last 7 days (2026-02-23 - 2026-03-02) See more at https://secdb.nttzen.cloud/dashboard Total CVEs: 974 Severity: - Critical: 145 - High: 315 - Medium: 431 - Low: 49 - None: 34 Status: - : 10 - Analyzed: 435 - Awaiting Analysis: 257 - Modified: 60 - Received: 119 - Rejected: 17 - Undergoing Analysis: 76 Top CNAs: - GitHub, Inc.: 354 - VulDB: 131 - VulnCheck: 70 - Mozilla Corporation: 52 - ICS-CERT: 51 - MITRE: 34 - Wordfence: 34 - Red Hat, Inc.: 15 - Cisco Systems, Inc.: 15 - GitLab Inc.: 13 Top Affected Products: - UNKNOWN: 459 - Mozilla Firefox: 52 - Mozilla Thunderbird: 50 - Imagemagick: 34 - Open-emr Openemr: 25 - Copeland Xweb 300d Pro Firmware: 15 - Freerdp: 15 - Copeland Xweb 500b Pro Firmware: 15 - Copeland Xweb 500d Pro Firmware: 15 - Tenda F453 Firmware: 10 Top EPSS Score: - CVE-2026-3301 - 2.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3301) - CVE-2025-70328 - 2.51 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70328) - CVE-2026-20127 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20127) - CVE-2025-70327 - 1.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70327) - CVE-2026-24663 - 1.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24663) - CVE-2026-22553 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22553) - CVE-2026-26222 - 0.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26222) - CVE-2026-26331 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26331) - CVE-2026-27498 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27498) - CVE-2026-21658 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21658)

View original post

Related Resources

Details

CVE ID: CVE-2025-70327
Severity: Critical
CVSS Score: 9.8
Type: command_injection
Status: unconfirmed
EPSS: 204.9%
Social Posts: 1

CWE

CWE-400

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

204.9%Probability of exploitation in the next 30 days