CVE-2026-15204 is a path traversal vulnerability affecting TOTOLINK X5000R firmware versions 9.1.0cu.2350_B20230313 and 9.1.0cu.2415_B20250515. The flaw exists in the exportOvpn function within the /web/cgi-bin/cstecgi.cgi script, part of the OpenVPN Export feature. An attacker can remotely exploit this vulnerability to manipulate file paths, potentially accessing files outside the intended directory. The vulnerability does not require privileges, user interaction, or authentication, and has a CVSS 4.0 score of 6.9 (medium severity). No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow a remote attacker to perform path traversal via the exportOvpn function, potentially leading to unauthorized file access on the affected device. This could expose sensitive configuration or system files. However, the vulnerability does not require authentication or user interaction, increasing its risk. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting remote access to the affected OpenVPN export functionality or limiting network exposure of the device to trusted networks only.