{"id":"CVE-2025-5504","published":"2025-06-03T14:31:10Z","modified":"2025-06-03T14:48:04Z","title":"TOTOLINK X2000R formWsc command injection","vendor":"TOTOLINK","product":"X2000R","tier":"core","eol":null,"affectedVersions":[{"vendor":"TOTOLINK","product":"X2000R","versions":["1.0.0-B20230726.1108"]}],"description":{"text":"A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWsc. The manipulation of the argument peerRptPin leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","provenance":"source","from":"CVE.org"},"summary":{"text":"The TOTOLINK X2000R router contains a command injection flaw in its /boafrm/formWsc component, where the peerRptPin argument is not properly neutralised before use. An attacker with low-privileged access can exploit it remotely over the network, with no user interaction needed, by supplying crafted input to that argument to run arbitrary commands on the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:45Z"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.13953,"percentile":0.96546,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-09","exploitedFirstSeen":"2025-10-09","ransomware":false,"evidence":[{"url":"https://www.trendmicro.com/en_us/research/25/j/rondodox.html","date":"2025-10-09"},{"url":"https://beelzebub.ai/blog/rondo-dox-v2/","date":"2025-11-04"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"references":[{"url":"https://vuldb.com/?id.310918","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.310918","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.584660","tags":["third-party-advisory"]},{"url":"https://github.com/fizz-is-on-the-way/Iot_vuls/blob/main/X2000R/RCE_formWsc/RCE_formWsc.md","tags":["exploit"]},{"url":"https://www.totolink.net/","tags":["product"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-16745","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16745","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://github.com/fizz-is-on-the-way/Iot_vuls/blob/main/X2000R/RCE_formWsc/RCE_formWsc.md"],"flow":[],"timeline":[{"date":"2025-06-03","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-5504","provenance":"source"},{"date":"2025-10-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trendmicro.com/en_us/research/25/j/rondodox.html","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":63.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 388 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.31,"detail":"percentile 0.9655"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.41,"detail":"base score 6.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}