Path Traversal in TOTOLINK X5000R Firmware

Compliance Impact

The vulnerability allows unauthenticated attackers to access OpenVPN user profile files or archives containing sensitive VPN credentials such as certificates, private keys, or server addresses. This unauthorized access could lead to exposure of sensitive personal or organizational data transmitted over the VPN.

Such exposure of sensitive data may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and health information against unauthorized access. If attackers exploit this vulnerability to gain unauthorized VPN access, it could result in data breaches violating these standards.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-15204 is a pre-authenticated file disclosure vulnerability in TOTOLINK X5000R routers, specifically in firmware versions 9.1.0cu.2415_B20250515 and 9.1.0cu.2350_B20230313. The flaw exists in the exportOvpn function of the /web/cgi-bin/cstecgi.cgi component, which handles OpenVPN exports.

An attacker can remotely exploit this vulnerability by manipulating the username parameter with path traversal sequences (../) to access OpenVPN user profile files or archives without authentication.

The vulnerability is limited by forced file suffixes: .ovpn for mode=config and .tar.gz for filetype=gz, but if these files contain sensitive VPN credentials such as certificates, private keys, or server addresses, unauthorized VPN access could be gained.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unauthenticated remote attacker to access sensitive OpenVPN configuration files containing VPN credentials.

If the attacker obtains certificates, private keys, or server addresses from these files, they could gain unauthorized access to the VPN network, potentially bypassing authentication controls.

Such unauthorized access could lead to data exposure, network intrusion, or further exploitation within the protected network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the path traversal in the exportOvpn function of the /web/cgi-bin/cstecgi.cgi endpoint on TOTOLINK X5000R routers running affected firmware versions.

A typical detection method involves sending HTTP requests that manipulate the username parameter with path traversal sequences (../) to try to access OpenVPN user profile files or archives.

Example curl commands to test for the vulnerability include:

• curl -v "http://<router-ip>/web/cgi-bin/cstecgi.cgi?exportOvpn&username=../../../../etc/passwd&mode=config"
• curl -v "http://<router-ip>/web/cgi-bin/cstecgi.cgi?exportOvpn&username=../../../../etc/passwd&filetype=gz"

If the response contains OpenVPN configuration files or archives, it indicates the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Restrict access to the router's web interface from untrusted networks to prevent remote exploitation.
• Apply any available firmware updates from TOTOLINK that address this vulnerability.
• If no patch is available, consider disabling the OpenVPN export functionality or restricting its usage.
• Monitor network traffic for suspicious requests targeting /web/cgi-bin/cstecgi.cgi with unusual username parameters.

These steps help reduce the risk of unauthorized access through the path traversal vulnerability.

Useful 0 Not Useful 0