The TOTOLINK X5000R router firmware version V9.1.0cu.2415_B20250515 has a denial-of-service vulnerability in the /cgi-bin/cstecgi.cgi management interface. The CGI script reads the CONTENT_LENGTH environment variable and allocates memory using malloc(CONTENT_LENGTH + 1) without sufficient bounds checking. If the lighttpd server's request size limit is not enforced, an attacker can send a crafted large POST request that causes memory exhaustion or a segmentation fault, crashing the CGI process and making the web interface unavailable. This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). There is no information about available patches or vendor advisories, and no known exploits in the wild have been reported.

Successful exploitation results in denial of service by crashing the management CGI process, causing loss of availability of the web interface. There is no impact on confidentiality or integrity reported. The medium CVSS score reflects the significant availability impact but limited scope of the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, enforcing request size limits on the lighttpd server or restricting access to the management interface may help mitigate the risk. Monitor vendor communications for official patches or updates.