CVE-2026-15204

Name of the Vulnerable Software and Affected Versions TOTOLINK X5000R versions 9.1.0cu.2350 B20230313 through 9.1.0cu.2415 B20250515

Description A path traversal issue exists in the OpenVPN Export component. A remote attacker can manipulate the exportOvpn() function within the '/web/cgi-bin/cstecgi.cgi' endpoint to access files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized.

Recommendations As a temporary workaround, restrict access to the '/web/cgi-bin/cstecgi.cgi' endpoint or disable the OpenVPN Export functionality until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.