The TOTOLINK X5000R router firmware versions 9.1.0cu.2350_B20230313 and 9.1.0cu.2415_B20250515 have a path traversal vulnerability in the exportOvpn function within the /web/cgi-bin/cstecgi.cgi file, which is part of the OpenVPN Export component. This vulnerability allows remote attackers to manipulate file paths, potentially accessing files outside the intended directory. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9 (medium severity). No vendor advisory or patch information is currently available, and no exploits are known to be in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform path traversal attacks via the exportOvpn function, potentially leading to unauthorized access to sensitive files on the device. The impact is limited to information disclosure or unauthorized file access, as indicated by the CVSS vector showing low confidentiality impact and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's management interface from untrusted networks to reduce exposure. Monitor official TOTOLINK communications for updates or patches addressing this vulnerability.