GCVE - cpe:2.3:a:totolink:x2000r:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:totolink:x2000r:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Totolink (`fa0129e6-aa24-5784-be77-22d8becdb79b`)
Product	X2000R (`007a68b7-5a2d-5dd8-8ef4-966a6e415c0d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-9577`	vulnerable	2026-06-08 07:45:22.727449	TOTOLINK X2000R Administrative shadow.sample default credentials LOW (2.5) A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component Administrative Interface. The manipulation results in use of default credentials. Attacking locally is a requirement. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be exploited. Published: 2025-08-28T18:32:07.573Z Updated: 2025-08-28T18:41:04.929Z Open on db.gcve.eu Reference links https://vuldb.com/?id.321691 https://vuldb.com/?ctiid.321691 https://vuldb.com/?submit.636069 https://github.com/XXRicardo/iot-cve/blob/main/TOLOLINK/X2000R-Gh-V2.0.0.md https://github.com/XXRicardo/iot-cve/blob/main/TOLOLINK/X2000R-Gh-V2.0.0.md#steps-to-reproduce	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-8181`	vulnerable	2026-06-08 07:45:19.772328	TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violation HIGH (7.2) A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiate the attack remotely. Published: 2025-07-26T07:02:07.845Z Updated: 2025-07-28T15:05:51.551Z Open on db.gcve.eu Reference links https://vuldb.com/?id.317595 https://vuldb.com/?ctiid.317595 https://vuldb.com/?submit.621966 https://vuldb.com/?submit.621968 https://www.notion.so/23a54a1113e780c08f3acca6a746d732	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5543`	vulnerable	2026-06-08 07:37:25.132362	TOTOLINK X2000R Parent Controls Page cross site scripting LOW (2.4) A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Parent Controls Page. The manipulation of the argument Device Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Published: 2025-06-03T22:31:06.988Z Updated: 2025-06-04T13:48:10.808Z Open on db.gcve.eu Reference links https://vuldb.com/?id.310993 https://vuldb.com/?ctiid.310993 https://vuldb.com/?submit.585728 https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/X2000R/XSS_parent_control https://www.totolink.net/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5542`	vulnerable	2026-06-08 07:37:25.131777	TOTOLINK X2000R Virtual Server Page formPortFw cross site scripting LOW (2.4) A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108. It has been classified as problematic. Affected is an unknown function of the file /boafrm/formPortFw of the component Virtual Server Page. The manipulation of the argument service_type leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Published: 2025-06-03T22:00:20.144Z Updated: 2025-06-04T13:48:49.038Z Open on db.gcve.eu Reference links https://vuldb.com/?id.310992 https://vuldb.com/?ctiid.310992 https://vuldb.com/?submit.585726 https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/X2000R/XSS_Virtual_Server https://www.totolink.net/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5516`	vulnerable	2026-06-08 07:37:25.071690	TOTOLINK X2000R URL Filtering Page formFilter cross site scripting LOW (2.4) A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20230726.1108. This affects an unknown part of the file /boafrm/formFilter of the component URL Filtering Page. The manipulation of the argument URL Address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-06-03T18:00:18.786Z Updated: 2025-06-03T18:21:49.966Z Open on db.gcve.eu Reference links https://vuldb.com/?id.310953 https://vuldb.com/?ctiid.310953 https://vuldb.com/?submit.584661 https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/X2000R/XSS_url_filtering https://www.totolink.net/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5515`	vulnerable	2026-06-08 07:37:25.071120	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5504`	vulnerable	2026-06-08 07:37:24.972533	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-0579`	vulnerable	2026-06-08 06:22:01.403178	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-7222`	vulnerable	2026-06-08 06:21:57.328684	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.