CVE-2025-9934

🗓️ 03 Sep 2025 22:32:13Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 10 Views🌐 WEB

CVE-2025-9934 on TOTOLINK X5000R enables remote command injection via cstecgi.cgi sub_410C34.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-9934	4 Sep 202505:22	–	circl
CNNVD	TOTOLINK X5000R 命令注入漏洞	4 Sep 202500:00	–	cnnvd
CNVD	TOTOLINK X5000R Command Injection Vulnerability	8 Sep 202500:00	–	cnvd
Cvelist	CVE-2025-9934 TOTOLINK X5000R cstecgi.cgi sub_410C34 command injection	3 Sep 202522:32	–	cvelist
EUVD	EUVD-2025-26655	3 Oct 202520:07	–	euvd
NVD	CVE-2025-9934	4 Sep 202510:42	–	nvd
OSV	CVE-2025-9934	4 Sep 202510:42	–	osv
Positive Technologies	PT-2025-35850	3 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-9934	5 Sep 202523:23	–	redhatcve
Vulnrichment	CVE-2025-9934 TOTOLINK X5000R cstecgi.cgi sub_410C34 command injection	3 Sep 202522:32	–	vulnrichment

NVD

Node

totolink x5000r_firmwareMatch9.1.0cu.2415_b20250515

AND

totolink x5000rMatch-

[
  {
    "vendor": "TOTOLINK",
    "product": "X5000R",
    "versions": [
      {
        "version": "9.1.0cu.2415_B20250515",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
github	www.github.com/Axelioc/CVE/blob/main/TOTOLINK/X5000R/sub_410C34/sub_410C34.md
github	www.github.com/Axelioc/CVE/blob/main/TOTOLINK/X5000R/sub_410C34/sub_410C34.md
totolink	www.totolink.net/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
pid	query param	/cgi-bin/cstecgi.cgi	Command injection via manipulation of the pid argument in /cgi-bin/cstecgi.cgi (TOTOLINK X5000R 9.1.0cu.2415_B20250515)	CWE-74, CWE-77

29 Apr 2026 01:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.16.3 - 9.8

CVSS 45.3

CVSS 26.5

CVSS 36.3

EPSS0.02419

SSVC