CVE-2025-70327
Published: 23 February 2026
Description
TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The ip parameter is retrieved via websGetVar and passed to a ping command through CsteSystem without validating if the input starts with a hyphen…
more
(-). This allows remote authenticated attackers to inject arbitrary command-line options into the ping utility, potentially leading to a Denial of Service (DoS) by causing excessive resource consumption or prolonged execution.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates validation of the 'ip' parameter to neutralize argument injection into the ping command executed via CsteSystem.
Requires timely flaw remediation to patch the argument injection vulnerability in the setDiagnosisCfg handler.
Mitigates the DoS impact from excessive resource consumption or prolonged ping execution caused by injected options.
Security SummaryAI
CVE-2025-70327 is an argument injection vulnerability affecting the TOTOLINK X5000R router running firmware version v9.1.0cu_2415_B20250515. The issue resides in the setDiagnosisCfg handler within the /usr/sbin/lighttpd executable, where the "ip" parameter is retrieved using websGetVar and passed directly to a ping command via CsteSystem without validation for inputs starting with a hyphen (-). This flaw corresponds to CWEs-88 (Improper Neutralization of Argument Delimiters in a Command) and CWE-400 (Uncontrolled Resource Consumption), earning a CVSS v3.1 base score of 9.8 (Critical: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers can exploit this vulnerability by supplying a malicious "ip" parameter that injects arbitrary command-line options into the ping utility. Although the description specifies remote authenticated attackers, the CVSS vector indicates no privileges (PR:N) are required. Successful exploitation enables denial-of-service (DoS) conditions through excessive resource consumption or prolonged execution of the ping command.
Advisories detailing the vulnerability, including potential mitigation steps, are available in the referenced reports at https://github.com/neighborhood-H/0-DAY/blob/main/Toto-link/X5000R/SetDiagnosisCfg/report.md and https://www.notion.so/TOTOLINK-X5000R-SetDiagnosisCfg-2d170566ca7f8098a0bcee9f2a15d40d?source=copy_link. Security practitioners should consult these for vendor-specific patch information or workarounds.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Public-facing router web interface vulnerable to unauthenticated argument injection (T1190), enabling DoS via ping resource exhaustion or abuse (T1499.004).