TOTOLINK X5000R Pre-Auth OpenVPN File Disclosure via exportOvpn (CVE-2026-06-09)

Vulnerability Overview Vulnerability Name: TOTOLINK X5000R exportOvpn Pre-Authenticated OpenVPN File Disclosure CVE ID: 2026-06-09 Publication Date: 2026-06-09 Affected Component: Affected Handler: Verification Status: Not a Remote Code Execution (RCE); current evidence supports the following scope: - Pre-authenticated disclosure of OpenVPN configuration files/archives - Path traversal constrained by suffix, using in the username field Scope Affected Versions: - V9.1.0cu_2415_B20250515 - V9.1.0cu_2350_B20230313 Vulnerability Request Format: Parser Location Sensitivity: - : Contains - : Type is user - : Username field, e.g., or - : Mode is or Impact: - An unauthenticated attacker can access the router's HTTP service to request existing OpenVPN user configuration files or archives. - If these files contain client certificates, private keys, static keys, server addresses, or reusable VPN credentials, the attacker may gain unauthenticated VPN access to the web interface. - The traversal behavior is subject to mandatory suffix constraints: - - - This should not be described as unrestricted arbitrary file read. Remediation Verification Status: - The issue was reproduced in a local QEMU/chroot CGI environment using the original firmware CGI and libraries. - This environment pre-created representative OpenVPN export files to simulate the runtime state of the configuration, as the firmware image does not include generated OpenVPN files by default. - Current evidence does not support an RCE (Remote Code Execution) claim. - Tests with shell metacharacters and URL-encoded metacharacters were performed, but no command execution was observed. Recommended CVSS Score: - CVSS v3.1: 7.5 High - Assuming the OpenVPN export files contain sensitive VPN access material. If the CNA considers the dependency on generating OpenVPN files to be a stronger environmental constraint, the Confidentiality impact may be lowered. Duplicate Check: - No identical public CVEs found. - Related but not identical CVEs: - CVE-2025-14506: OS command injection affecting V9.1.0cu_2000_B20211224 - CVE-2025-13104: Unauthenticated Telnet enablement via on another X5000R firmware - CVE-2025-9934: command injection in function via parameter affecting V9.1.0cu_2415_B20250515 - This candidate is limited to file disclosure and suffix-constrained path traversal; it does not involve Telnet enablement or command injection. Files Core Reports: - - - - - - Email Materials: - - Evidence and PoC: - - - - Integrity Repository-level file hashes can be found at: - POC Code The above are key information summaries based on the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

TOTOLINK X5000R Pre-Auth OpenVPN File Disclosure via exportOvpn (CVE-2026-06-09)

More from this source