CVE-2025-70329 - Vulnerability Analysis

Overview

TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection caused by inadequate validation of vlanVidLanX parameters in setIptvCfg handler of /usr/sbin/lighttpd, letting authenticated attackers execute arbitrary shell commands with root privileges.

Severity & Score

Impact

Authenticated attackers can execute arbitrary commands as root, leading to full system compromise.

Mitigation

Update to the latest version with proper input validation or apply vendor patches.

References

• https://www.notion.so/TOTOLINK-X5000R-SetIptvCfg-2d170566ca7f8027ad47e6b5429025fc?source=copy_link
• https://github.com/neighborhood-H/0-DAY/blob/main/Toto-link/X5000R/SetIptvCfg/report.md

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 23, 2026

🟠 CVE-2025-70329 - High (8) TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlanVidLan1 (and other vlanVidLanX) parameters are retrieved via Uci_Get_Str and passed to t... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70329/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner